joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53f110
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x334
mov al, byte [ebp + 0xc]
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x340], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x138], esi
test al, 1
je 0x53f164
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x33c], ecx
mov ecx, 1
mov dword [ebp - 0x340], ecx
jmp 0x53f169
mov ecx, 1
test al, 2
je 0x53f17c
mov edx, dword [ebx + 0x20]
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], ecx
test al, 4
je 0x53f18f
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00580f60
mov dword [ebp - 4], esi
mov edi, edi
mov edx, dword [0x5b93e4]
mov eax, dword [0x5b93e0]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push edx
push eax
push edi
push esi
call fcn.00553d40
push 0
push 0xf4240
push edi
push esi
mov dword [ebp - 0x34], eax
call fcn.00553d40
imul eax, eax, 0xf4240
sub esi, eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x30], esi
call fcn.00581000
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x138]
push edx
mov edx, dword [ebx + 0x20]
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x340]
push ecx
inc edx
push edx
mov byte [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x53f283
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x53f283
lea ecx, [ebp - 0x2c]
call fcn.00581000
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sbb ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 2
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00580f80
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp eax, dword [ebp - 0x10]
jl 0x53f25f
jg 0x53f251
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
jbe 0x53f25f
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x14]
call fcn.00580fa0
jmp 0x53f26b
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00580f80
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00416250
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00416250
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.00416250
test esi, esi
jns 0x53f2a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x53f1a0
call fcn.0053eab0
lea ecx, [ebp - 0x14]
setg bl
mov dword [ebp - 4], 0xffffffff
call fcn.00416250
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x53f2d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x20], 0xffffffff
jne 0x53f2fd
push 0x1cb
push str...PocoNet_srcSocketImpl.cpp
push str._sockfd___POCO_INVALID_SOCKET
call fcn.00535310
add esp, 0xc
mov edx, dword [esi + 0x20]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edx
mov dword [ebp - 4], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x53f335
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.0053aca0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.0053eab0
int3

Function at 0x53f530
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5979bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0xffffffff
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
je 0x53f573
push 0x73
push str...PocoNet_srcSocketImpl.cpp
push str._sockfd__POCO_INVALID_SOCKET
call fcn.00535310
add esp, 0xc
mov ebx, dword [ebp + 8]
mov edi, dword [esi]
mov ecx, ebx
call fcn.0053ac90
push eax
mov eax, dword [edi + 0x78]
mov ecx, esi
call eax
push 0
mov ecx, esi
call fcn.0053f4f0
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.0053b7e0
mov ecx, ebx
mov edi, eax
call fcn.0053b7d0
mov ecx, dword [esi + 0x20]
push edi
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x53f65d
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2734
je 0x53f5e8
call edi
cmp eax, 0x2733
je 0x53f5e8
lea edx, [ebp - 0x78]
push edx
mov ecx, ebx
call fcn.0053af70
push eax
mov byte [ebp - 4], 1
call fcn.0053eaf0
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
push 3
push ecx
mov ecx, esi
call edx
test al, al
jne 0x53f64c
push 0x11
push str.connect_timed_out
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], al
call fcn.0040a960
lea eax, [ebp - 0x94]
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0053af70
push eax
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.00537a10
push 0x5e2dcc
lea edx, [ebp - 0x5c]
push edx
call fcn.00554cbc
mov ecx, esi
call fcn.0053df20
test eax, eax
je 0x53f65d
push eax
call fcn.0053eb10
push 1
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0053f4f0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53f6a0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x596da8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0xffffffff
push edi
mov edi, dword [ebp + 8]
jne 0x53f6db
push ebx
mov ebx, dword [esi]
mov ecx, edi
call fcn.0053ac90
push eax
mov eax, dword [ebx + 0x78]
mov ecx, esi
call eax
pop ebx
push 0
mov ecx, esi
call fcn.0053f4f0
mov ecx, edi
call fcn.0053b7e0
push eax
mov ecx, edi
call fcn.0053b7d0
mov ecx, dword [esi + 0x20]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x53f732
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2734
je 0x53f732
call esi
cmp eax, 0x2733
je 0x53f732
lea edx, [ebp - 0x28]
push edx
mov ecx, edi
call fcn.0053af70
push eax
mov dword [ebp - 4], 0
call fcn.0053eaf0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x552f9a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x5fd7f0], 0
push esi
push edi
jne 0x552f10
call fcn.00552e7c
test eax, eax
je 0x552f55
mov eax, dword [0x5fd7f0]
cmp eax, 1
jne 0x552f31
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x552f55
jmp 0x552f97
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x552f97
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x552f59
xor eax, eax
jmp 0x552f97
mov eax, dword [esi]
push dword [0x5fd7f0]
call edi
mov edi, eax
test edi, edi
je 0x552f7b
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x552f97
lea edi, [esi + 0xff0]
push esi
push dword [0x5fd7f0]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x552f81
mov eax, esi
pop edi
pop esi
ret
jmp 0x552efc

Function at 0x55dffb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5f5cf4]
jne 0x55e005
repz ret
jmp fcn.00573cbc
Function at 0x567fc0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5f5cf4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00562d6f
and dword [ebp - 0x14], 0
cmp dword [0x5fe0cc], 0
mov dword [ebp - 0x18], eax
jne 0x568073
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x56811b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5b3324
push ebx
call edi
test eax, eax
je 0x56811b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5b3314
push ebx
mov dword [0x5fe0cc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5fe0d0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5fe0d4], eax
call edi
push eax
call esi
mov dword [0x5fe0dc], eax
test eax, eax
je 0x568073
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5fe0d8], eax
mov eax, dword [0x5fe0d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5680cc
cmp dword [0x5fe0dc], ecx
je 0x5680cc
push eax
call esi
push dword [0x5fe0dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5680cc
test ebx, ebx
je 0x5680cc
call edi
test eax, eax
je 0x5680c3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x5680c3
test byte [ebp - 8], 1
jne 0x5680cc
or dword [ebp + 0x10], 0x200000
jmp 0x5680ff
mov eax, dword [0x5fe0d0]
cmp eax, dword [ebp - 0x18]
je 0x5680ff
push eax
call esi
test eax, eax
je 0x5680ff
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5680ff
mov eax, dword [0x5fe0d4]
cmp eax, dword [ebp - 0x18]
je 0x5680ff
push eax
call esi
test eax, eax
je 0x5680ff
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5fe0cc]
call esi
test eax, eax
je 0x56811b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x56811d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055dffb
leave
ret
Function at 0x40107e
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x42f708]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [0x42f70c]
push edi
mov edi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x2c], 0x9e3779b9
call fcn.00401077
mov eax, dword [0x42f710]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x42f714]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x43e95c], 0xc
mov dword [ebp - 4], eax
jne 0x401103
push edx
lea eax, [ebp - 0x38]
push eax
push edx
lea eax, [ebp - 0x438]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x43e95c]
cmp eax, 0xfa9
jne 0x40111f
mov dword [0x43e958], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401135
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and dword [0x43e8ac], 0
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [0x43e954], 0xf4ea3dee
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x4010d3
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x4078df
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ec70]
jne 0x4078e9
repz ret
jmp fcn.0040c209

Function at 0x40a726
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403abe
and dword [ebp - 4], 0
cmp dword [0x43393c], 0
mov ebx, eax
jne 0x40a7d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a888
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a888
push eax
call fcn.00403a4c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43393c], eax
call esi
push eax
call fcn.00403a4c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433940], eax
call esi
push eax
call fcn.00403a4c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433944], eax
call esi
push eax
call fcn.00403a4c
pop ecx
mov dword [0x43394c], eax
test eax, eax
je 0x40a7d7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403a4c
pop ecx
mov dword [0x433948], eax
mov eax, dword [0x433948]
cmp eax, ebx
je 0x40a82f
cmp dword [0x43394c], ebx
je 0x40a82f
push eax
call fcn.00403ac7
push dword [0x43394c]
mov esi, eax
call fcn.00403ac7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a82f
test edi, edi
je 0x40a82f
call esi
test eax, eax
je 0x40a826
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a826
test byte [ebp - 0xc], 1
jne 0x40a82f
or dword [ebp + 0x10], 0x200000
jmp 0x40a868
mov eax, dword [0x433940]
cmp eax, ebx
je 0x40a868
push eax
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40a868
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a868
mov eax, dword [0x433944]
cmp eax, ebx
je 0x40a868
push eax
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40a868
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43393c]
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40a888
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a88a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
test si, si
jl 0x100014e4
movsx eax, si
cmp eax, dword [0x1000ff68]
jge 0x100014e4
push 0x1000ff6c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.10001610
add esp, 4
test eax, eax
je 0x10001487
push 0x1000ff6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xf0
pop esi
ret
push esi
call 0x10001680
add esp, 4
test eax, eax
je 0x100014d2
mov ecx, dword [0x1000ff60]
inc dword [0x1000ff64]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100014c3
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [0x1000ff60]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x1000ff6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop esi
ret
push 0x1000ff6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xf3
pop esi
ret
mov eax, 0xf2
pop esi
ret

Function at 0x100015d0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1000160b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x100015f2
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10001603
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1000160d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x100015e8
xor eax, eax
pop edi
pop esi
ret
Function at 0x10009095
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10004e48
and dword [ebp - 4], 0
cmp dword [0x10020d28], 0
mov ebx, eax
jne 0x10009146
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100091f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100091f7
push eax
call fcn.10004dd6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10020d28], eax
call esi
push eax
call fcn.10004dd6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10020d2c], eax
call esi
push eax
call fcn.10004dd6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10020d30], eax
call esi
push eax
call fcn.10004dd6
pop ecx
mov dword [0x10020d38], eax
test eax, eax
je 0x10009146
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10004dd6
pop ecx
mov dword [0x10020d34], eax
mov eax, dword [0x10020d34]
cmp eax, ebx
je 0x1000919e
cmp dword [0x10020d38], ebx
je 0x1000919e
push eax
call fcn.10004e51
push dword [0x10020d38]
mov esi, eax
call fcn.10004e51
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000919e
test edi, edi
je 0x1000919e
call esi
test eax, eax
je 0x10009195
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10009195
test byte [ebp - 0xc], 1
jne 0x1000919e
or dword [ebp + 0x10], 0x200000
jmp 0x100091d7
mov eax, dword [0x10020d2c]
cmp eax, ebx
je 0x100091d7
push eax
call fcn.10004e51
pop ecx
test eax, eax
je 0x100091d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100091d7
mov eax, dword [0x10020d30]
cmp eax, ebx
je 0x100091d7
push eax
call fcn.10004e51
pop ecx
test eax, eax
je 0x100091d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10020d28]
call fcn.10004e51
pop ecx
test eax, eax
je 0x100091f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100091f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 0x461524
push 2
call fcn.0040aa90
add esp, 4
push eax
call fcn.004025a0
add esp, 0xc
push 2
call fcn.00418ba0
pop ebp
ret

Function at 0x402630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x461da0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0041ad1f
add esp, 4
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x402759
mov dword [ebp - 0x108], 0
jmp 0x40267d
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
cmp dword [ebp - 0x108], 2
jge 0x402759
lea edx, [ebp - 0x110]
push edx
push 0x20019
push 0
push str.SoftwareVI_Like_EmacsEnvironment
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax*4 + 0x4617ac]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402754
mov dword [ebp - 0x10c], pe_nt_image_headers32
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x104]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402747
cmp dword [ebp - 0x10c], 0
je 0x402747
mov eax, dword [ebp - 0x10c]
sub eax, 1
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x100
jae 0x402710
jmp 0x402715
call fcn.004059b0
mov ecx, dword [ebp - 0x118]
mov byte [ebp + ecx - 0x104], 0
lea edx, [ebp - 0x104]
push edx
call fcn.00402770
add esp, 4
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402759
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40266e
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405aa0
mov esp, ebp
pop ebp
ret
Function at 0x402cd0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0
jne 0x402cf8
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
push 0x461760
call fcn.00403150
add esp, 8
push 0x400
push 0
push 0x463960
call fcn.00406d80
add esp, 0xc
mov dword [ebp - 8], 1
jmp 0x402d1e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 8]
jge 0x402eb4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
jne 0x402d4d
mov eax, dword [ebp - 4]
push eax
push 0x461768
call fcn.00403150
add esp, 8
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2d
jne 0x402ead
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
je 0x402eab
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, dword [ecx*4 + 0x463960]
add edx, 1
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov dword [ecx*4 + 0x463960], edx
mov edx, dword [ebp - 4]
mov al, byte [edx]
mov byte [ebp - 0x10], al
cmp byte [ebp - 0x10], 0x6b
je 0x402da9
cmp byte [ebp - 0x10], 0x74
je 0x402de7
jmp 0x402e3c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00402c50
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], 0
je 0x402de2
mov edx, dword [ebp - 0xc]
push edx
call fcn.00403de0
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.00404190
add esp, 4
jmp 0x402ea6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00402c50
add esp, 0x10
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.0041a9b0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 4
imul ecx, eax, 0x74
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x463960], edx
cmp dword [ebp - 0x14], 0
jg 0x402e3a
mov eax, 4
imul ecx, eax, 0x74
mov dword [ecx + 0x463960], 8
jmp 0x402ea6
cmp dword [0x461010], 0
je 0x402e5f
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
push eax
mov ecx, dword [0x461010]
push ecx
call fcn.00406c50
add esp, 8
test eax, eax
je 0x402e68
cmp dword [0x461010], 0
jne 0x402ea6
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
push eax
push str.ivqQ
call fcn.00406c50
add esp, 8
test eax, eax
jne 0x402ea6
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
push edx
push str.unknown_option__c_n
push 2
call fcn.0040aa90
add esp, 4
push eax
call fcn.004025a0
add esp, 0xc
push 1
call fcn.00418ba0
jmp 0x402d5c
jmp 0x402eaf
jmp 0x402eb4
jmp 0x402d15
cmp dword [ebp + 0x10], 0
jne 0x402ed6
push 1
call fcn.0040aa90
add esp, 4
push eax
push 1
push 1
push 0x462744
call fcn.0040cf70
add esp, 0x10
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret