joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499a30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret
Function at 0x499b50
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4d506c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x128], edi
mov eax, dword [edi + 8]
mov dword [ebp - 0x108], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x120], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x10c], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x118], eax
mov eax, dword [edi + 0x24]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp + 0xc]
add eax, 2
nop
movzx edx, byte [eax - 2]
lea eax, [eax + 4]
movzx ecx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 3]
shl edx, 8
or edx, ecx
mov dword [ebp + esi*4 - 0x104], edx
inc esi
cmp esi, 0x10
jl 0x499bc0
lea ebx, [ebp - 0xcc]
mov edi, 0x30
nop word [eax + eax]
mov ecx, dword [ebx - 0x34]
lea ebx, [ebx + 4]
mov edx, dword [ebx - 4]
mov esi, ecx
mov eax, ecx
rol esi, 0xe
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub edi, 1
jne 0x499c00
mov edi, dword [ebp - 0x128]
xor ebx, ebx
mov ecx, dword [ebp - 0x11c]
nop dword [eax]
mov esi, dword [ebp - 0x108]
mov edx, ecx
mov eax, ecx
ror edx, 0xb
rol eax, 7
xor edx, eax
mov eax, ecx
ror eax, 6
xor edx, eax
mov eax, dword [ebp - 0x114]
xor eax, dword [ebp - 0x118]
and eax, ecx
mov ecx, esi
xor eax, dword [ebp - 0x118]
add edx, eax
ror ecx, 0xd
add edx, dword [ebx + 0x4af230]
mov eax, esi
add edx, dword [ebp + ebx - 0x104]
add ebx, 4
add edx, dword [ebp - 0x124]
add dword [ebp - 0x10c], edx
rol eax, 0xa
xor ecx, eax
mov eax, esi
ror eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x120]
mov esi, eax
add ecx, edx
and eax, dword [ebp - 0x108]
or esi, dword [ebp - 0x108]
and esi, dword [ebp - 0x110]
mov edx, dword [ebp - 0x108]
or esi, eax
mov eax, dword [ebp - 0x118]
add esi, ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x108], esi
cmp ebx, 0x100
jl 0x499c50
add dword [edi + 8], esi
add dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10c]
add dword [edi + 0x14], eax
mov eax, dword [ebp - 0x114]
add dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x118]
add dword [edi + 0x20], eax
add dword [edi + 0x18], ecx
mov eax, dword [ebp - 0x124]
add dword [edi + 0x24], eax
xor eax, eax
add dword [edi + 0xc], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049abdf
mov esp, ebp
pop ebp
ret
Function at 0x49aa80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x49aaad
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x49aaf4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x49aafa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x49ab5b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x49ab20
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x49ab87
mov eax, dword [esi + 4]
push 1
push 0x4af436
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x4af437
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x49ab60
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x348b7eca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x348b7ed9
pop dword [ebp - 0x2c]
mov eax, 0x348b7ed9
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x7a63c9ea
add dword [ebp - 0x3c], 0xd3ee7b61
mov dword [ebp - 0x38], 0xd80897c2
sub dword [ebp - 0x38], 0xa5d54b7d
mov dword [ebp - 0x34], 0x2ae5eb9e
sub dword [ebp - 0x34], 0xde99a770
mov dword [ebp - 0x30], 0xd051bb50
add dword [ebp - 0x30], 0x2fae44b0
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x2fa2b644
sub dword [ebp - 0x3c], 0xbb304cee
mov dword [ebp - 0x38], 0xe9bdb541
sub dword [ebp - 0x38], 0xa85153cc
mov dword [ebp - 0x34], 0xb93f1373
sub dword [ebp - 0x34], 0x55cfa707
mov dword [ebp - 0x30], 0xca5c8314
add dword [ebp - 0x30], 0x35a37cec
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x3ba4ff54
add eax, 0xf8e4126c
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c5d0
push 0
call eax
mov ecx, 0x3af2
xor ebx, ebx
add ebx, eax
mov esi, 0x8938eefc
sub esi, 0x54ac3efc
add esi, dword [ebp - 0x2c]
mov edi, 0x404f5ab5
add dword [ebp - 4], 0x33c67181
mov edx, dword [esi]
xor dword [ebp - 0x1c], 0xcb1793cf
xor edx, edi
xor dword [ebp - 0x28], 0xdb496aa8
mov dword [ebx], edx
xor dword [ebp - 0x24], 0xc0977c1d
add ebx, 0x7c0eb3d0
add ebx, 0x83f14c34
add esi, 0xf2a44e34
sub esi, 0xf2a44e30
loop 0x348b7fe7
add eax, 0xde9b
xor ebx, ebx
add ebx, eax
add eax, 0x9fe445f
sub eax, 0x9fe445a
mov ecx, 0x34890000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4de325
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4dee10
ror al, 7
test dh, cl
clc
pushfd
add al, 0xbc
cmc
neg al
mov byte [esp + 0x14], dh
mov byte [esp], al
bt bp, 1
cmp dl, 0xb3
cmp al, byte [edi]
bswap eax
mov dword [esp], 0xa8d5d834
call fcn.004d883a
add byte [eax], al
insd dword es:[edi], dx
arpl word [ecx + 0x53], bp
outsb dx, byte gs:[esi]
push ebx
je 0x4deeb9
imul ebp, dword [esi + 0x67], 0x648d0057
and al, 8
div dh
cmpsd dword [esi], dword es:[edi]
invalid

Function at 0x4e1ff2
Capabilities:
Authenticate hmac

Disassembly:
cmc
add al, 0x29
mov word [esp], 0x4a99
pushfd
push 0x4a6ef34
shr eax, 1
call fcn.004d8213
add byte [eax], al
mov al, byte [0xa0080046]
inc esi
add byte [eax], al
dec ebp
inc esi
add byte [eax - 0x2f], dl
dec edx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx], bh
mov dh, byte [ebx]
push ebp
test byte [ebx - 0x74e88e95], bh
xor byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp ecx, dword [edx - 0x447baacd]
imul esi, dword [ecx + 0x17], 0xffffff8b
push 0x4bccc2f1
sbb byte [edi + 0x3f15a358], ah
shr dword [eax - 0x3b], 1
in al, 0xd3
xchg ebx, eax
cmp dword [edx], esp
rcl dword [ebx]
xor dword [esi + 0x1b], ebp
jnp 0x4ad185
aas
invalid
jo 0x4ad150
jo 0x4ad1fd
pushal
test dh, bl
outsb dx, byte [esi]
and dword [ebx - 0x2e], edx
xor al, 0x30
push ds
sub dword [ebx - 0x3b], 0x5c
sub eax, 0xb6576723
jp 0x4ad122
mov esi, 0x5a3fbd89
fnstenv [edi]
and ecx, dword [ebx + 0x1108b2e]
shr byte [edi - 0x3862c175], cl
aad 0x78
xchg ebx, eax
push ds
push cs
js 0x4ad14e
cli
insd dword es:[edi], dx
sbb al, 7
mov ch, 0x79
cmp ebx, dword [esi]
push ds
in al, 0xb8
cmp ebx, edi
jns 0x4ad1c0
and al, 0x17
popfd
push esi
mov byte [0x1a16f99d], al
imul ebp, dword [edi + ecx*8], 0x3dfa372e
xchg edi, eax
insd dword es:[edi], dx
jge 0x4ad227
cmpsd dword [esi], dword es:[edi]
mov ebx, 0x9c12c34f
pop esi
pop edx
inc edi
push ebx
mov ebx, 0x1168c0cd
lodsb al, byte [esi]
adc al, 0x51
std
adc ecx, 0xedbd6000
cmpsd dword [esi], dword es:[edi]
sbb eax, 0xff367f3
cli
int1
ret
dec edi
push ds
adc al, 0xd1
mov ah, 0x93
pop edi
retf 0x66e8
out 0x17, al
imul edx, dword [ebp + 0xd2a1a48], 0xa4c86175
xchg ebp, eax
dec eax
sbb ch, byte [edx]
or eax, 0xa4c86175
or al, 0xfa
dec ecx
leave
or bl, byte [ecx + 0x3552df34]
jecxz 0x4ad2af
test byte [edi], ah
and eax, 0x354cb9d5
call ebx
inc ebp
mov byte [edx - 0x319028c3], ch
je 0x4ad1eb
ficomp word [esi - 0x63]
push cs
fstp qword [ecx - 0x7206e0f8]
xlatb
sub dl, byte [eax + edi - 0xc]
aam 0xb0
jmp 0x4ad224
ljmp 0x2fd:0xe3e55a28
pushfd
clc
jmp 0x4ad121
seto al
lodsb al, byte [esi]
test bx, 0x73ce
pushal
pushfd
push 0x4e080df3
neg al
bt sp, 4
pushfd
pushfd
rol al, 3
mov byte [esp + 0x10], al
stc
stc
not al
lea esp, [esp + 0x34]
jo 0x4d96a6
clc
pushal
add al, 0x29
stc
clc
clc
cmp cx, bx
shr eax, 1
mov byte [esp], al
lea esp, [esp + 0x20]
je 0x4e0dfd
jmp 0x4e8748
jmp 0x4e9a21
pushfd
adc ecx, ecx
push edx
lea esp, [esp + 8]
jmp 0x4d9292
Function at 0x4e31e4
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x20]
je fcn.004e8cad
push 0x98dab4ef
cmc
pushfd
cmp bx, di
add eax, edi
stc
clc
stc
cmp eax, edx
push ecx
call fcn.004d9622
push 0xf158b5b2
push 0x33e6a7c1
push dword [esp]
mov dword [esp + 8], eax
mov al, dh
push 0x46a62812
lodsb al, byte [esi]
cmc
mov byte [esp], 0x9c
mov byte [esp], bl
test bh, 0xd3
not al
test esp, esp
test ah, dh
add al, 0x2d
cmc
stc
stc
jmp 0x4e67e2
pushfd
cmp ecx, dword [ebp - 4]
call 0x4e25e2
pushal
push dword [esp]
push dword [esp]
mov dword [esp + 0x24], 0x4d2700a9
call fcn.004d95f6
pushfd
jmp 0x4e78e3
shrd di, bp, cl
mov edi, dword [edx + 0x24]
cmp eax, 0x21c88906
stc
bt di, 0xe
add edi, eax
clc
pushal
stc
movzx ecx, word [edi + ecx*2]
inc di
shr di, cl
mov edi, dword [edx + 0x1c]
cmc
push dword [esp + 4]
pushal
add edi, eax
cmc
mov byte [esp], ch
cmp bp, di
lea esp, [esp + 0x44]
jp 0x4e94c3
mov edi, dword [edi + ecx*4]
pushal
test dx, 0x5505
test edi, edi
jmp 0x4ad100
ror al, 7
test cl, bl
pushal
call int.004e958c
lea esp, [esp + 0x44]
ja 0x4e268d
push 0x33912563
lea esp, [esp + 4]
jb 0x4e333c
cmc
pushfd
cmp byte [edi - 1], 0
push ebx
pushfd
lea esp, [esp + 0xc]
jne 0x4d8cf7
sub di, 0x33e
jmp 0x4e4812
jmp 0x5208f2
Function at 0x4e67ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xchg esp, eax
or al, al
dec ebx
in eax, 0x25
mov eax, 0xeb302d74
sbb eax, 0xaab7a3eb
inc esp
mov ch, 0xad
sub eax, 0xeb1deb30
mov dword [0xb544aab7], eax
lodsd eax, dword [esi]
push ss
std
pop esi
sub ebx, dword [ecx - 7]
adc edi, dword [edx - 0x527daf57]
pop edx
mov al, 0xb3
fdivr qword [esi]
ret
invalid
movsd dword es:[edi], dword [esi]
or eax, 0x60cca511
pop eax
cmp al, 0x8c
jge 0x4d91e7
and byte [ebx - 0x204fea29], dh
out 0x54, eax
push esp
cmpsb byte [esi], byte es:[edi]
jne 0x4d92c5
insd dword es:[edi], dx
mov dx, dx
sub eax, 0x3333aad7
insd dword es:[edi], dx
add al, 0x2e
inc esi
in al, 0x39
mov dl, 0xaf
jb 0x4d91ef
js 0x4d9235
shl byte [ebp - 0x1a9abf03], 0x92
test ecx, ebx
ja 0x4d9298
mov al, byte [0x1de1a05b]
fdiv qword [edi - 0x5f]
call 0x9fcab471
invalid
push 0xddd6567c
call fcn.004e7c41
mov edx, 0x9e2f3729
jns 0x4d92b0
movsd dword es:[edi], dword [esi]
jmp 0x2a07929e
lodsb al, byte [esi]
loopne 0x4d922f
push 0xfffffffffffffff6
cmp al, 0x62
jnp 0x4d9247
cmc
ret 0x7e7c
mov eax, 0x1e5fb7a2
mov ah, 0xb5
ja 0x4d92c6
fbld tbyte [edi]
sbb dword [edi], ebx
dec ebx
retf 0x5569
push 0x494a6ab8
push 0x57704d5c
mov eax, 0x68494a6a
pop esp
dec ebp
jo 0x4d9326
inc esi
fidivr word [ebx]
rcl dword [edx + 0x23], cl
mov dh, 0x1a
invalid
sub eax, 0xe31313e1
mov cl, 0x86
invalid
add byte [esi + 0x3a5388b5], al
push ecx
xchg byte [edx + 0x49a19da2], dh
pop ss
aam 5
int3
jo 0x4d9310
mov ebx, 0x815f612e
je 0x4d92f5
movsb byte es:[edi], byte [esi]
les edi, [eax - 0x16767edf]
sar byte [esi - 0x6f], 0xe5
bnd ret
xchg di, si
push 0x2dd17f4b
pop ebx
xchg bx, di
pop ebx
pushal
lea ebp, [edx + 0x77b8af19]
push dword [esp + 8]
call fcn.004d94a1
aas
push ds
loope 0x4e0df3
cmp dword [edi], edi
lcall 0x3795, 0x6aa70eca
mov ecx, 0x195f8d20
and dh, cl
in eax, dx
outsb dx, byte [esi]
aad 0x36
bound edx, qword [ecx]
mov esp, 0xd0e6a319
arpl word [esi], dx
jbe 0x4e0e21
retf 0xa70e
add eax, 0xce667376
movsd dword es:[edi], dword [esi]
test al, 5
shr byte [eax*8 - 0x49c4acb8], 1
mov eax, 0xaf4e5f76
dec esi
scasd eax, dword es:[edi]
lea ecx, [ebp + ebx*8 + 0x75004dfd]
push ecx
pop eax
out dx, eax
mov al, 0x1a
or edi, dword [eax + 0x5a391943]
std
jmp 0x4e0eb9
bound esi, qword [esi - 0x58]
pop edi
in al, 0x5e
mov ch, 0x13
mov cl, 0xb0
inc ebp
dec ebx
dec esi
stosb byte es:[edi], al
mov byte [0xc0b11121], al
lds esp, [edi + 0x21832d91]
dec edx
js 0x4e0e4f
invalid
mov eax, 0x9e3dd7f9
adc byte [edi], 0x89
scasb al, byte es:[edi]
cld
push cs
stc
cmp al, 0x1d
xlatb
inc ebp
mov eax, dword [0xe30d7200]
pop es
test dword ds:[edx], edx
in al, 0x53
jecxz 0x4e0e69
xor byte [edx - 0xc9bbf08], al
mov ch, 0xae
out dx, al
lodsb al, byte [esi]
push edi
and dword [esi - 0x5528c718], esi
add byte [ebx], bl
cmp bh, cl
xchg ebx, eax
xchg ebp, ecx
mov bl, 0x49
shl byte [ebx], 1
and ebx, dword [edx]
push 0xffffffffffffff8b
pushal
inc ebp
xchg dword cs:[ebx + ecx*4], eax
dec edi
or byte [edx + 0xa], bh
in al, dx
pop es
invalid
lea esp, [esp + 0x14]
je 0x4e0dfd
push ebp
push dword [esp]
adc ecx, ecx
pushal
pushfd
mov byte [esp + 4], ah
pushfd
lea esp, [esp + 0x30]
jmp 0x4d9292
Function at 0x4e68e5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
setne ah
mov byte [edi - 1], 0
setnp al
lea eax, [esi + 0x65dc5fd5]
not ah
bswap ax
push ebx
movsx eax, cl
cwde
lea eax, [0x4dee0a]
pushal
mov word [esp], bx
mov dword [esp + 4], 0xa2c249ac
mov dword [esp + 0x1c], 0x4e884e
pushal
mov dword [esp + 0x38], eax
push ebp
pushfd
push dword [esp + 0x40]
ret 0x44
mov byte [esp], bl
lea esp, [esp + 0x44]
ja 0x4e2267
xor al, bl
cmc
inc al
clc
sub ebx, edi
ror edi, cl
add ebx, esp
rcr al, 5
neg di
inc di
mov edi, ebx
shr al, 6
and al, bl
clc
mov al, 0x2e
pushal
pushal
repne scasb al, byte es:[edi]
push dword [esp + 4]
pushfd
pushfd
lea esp, [esp + 0x4c]
jne 0x4e62a6
jmp 0x4ad449
Function at 0x10015529
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10015561
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001555c
push 0x837
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x10015688
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0xfffffff9
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x100155e2
mov dword [ebp - 0x10], 1
jmp 0x100155e6
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10015607
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x100155fe
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x10015607
mov dword [ebp - 8], 1
jmp 0x1001560b
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x1001563d
push 4
pop eax
test eax, eax
jne 0x1001563d
and dword [ebp - 0x14], 0
jmp 0x10015644
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
sub eax, 4
mov ecx, dword [ebp - 0x58]
cmp eax, dword [ecx]
jg 0x1001565a
mov dword [ebp - 0x18], 1
jmp 0x1001565e
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
sub eax, 0x78317d23
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0xffffffff
jg 0x1001567c
mov dword [ebp - 0x20], 1
jmp 0x10015680
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10016541
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10016579
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10016574
push 0xf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10016689
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100165bf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jg 0x10016689
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.10019992
cmp dword [eax], 0
jg 0x100165ee
mov dword [ebp - 0xc], 1
jmp 0x100165f2
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.10019992
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
jg 0x1001660f
mov dword [ebp - 0x10], 1
jmp 0x10016613
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x34ca
jl 0x10016625
mov dword [ebp - 0x14], 1
jmp 0x10016629
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.10019992
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
jge 0x10016646
mov dword [ebp - 0x1c], 1
jmp 0x1001664a
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jne 0x1001665d
mov dword [ebp - 0x38], 1
jmp 0x10016661
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.10019992
push 1
mov ecx, dword [ebp - 8]
call fcn.10019992
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
mov dword [eax], ecx
jmp 0x100165b4
mov esp, ebp
pop ebp
ret
Function at 0x1002c81b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002c83a
push 0xf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1002c886
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push 0
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov eax, dword [ebp - 0x20]
push dword [eax]
call fcn.10033c6e
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10035365
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x1ae2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.10035141
add esp, 0x10
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003539a
xor eax, eax
jmp 0x100354e7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100353b8
xor eax, eax
jmp 0x100354e7
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0x40b
push 0x4299
push 1
call fcn.10034e00
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x100353e0
xor eax, eax
jmp 0x100354e7
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0x76a6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x479a
call fcn.1003518c
add esp, 0x20
push 0
push 0x7fc5
push 0x3bc9
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1002dcfc
add esp, 0x18
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x4f15
push 0x669a
lea eax, [ebp - 0x1c]
push eax
push 0xc25
call fcn.100354eb
add esp, 0x1c
push 1
push 0x1118
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003524e
add esp, 0x10
push dword [ebp - 4]
call fcn.10034cec
pop ecx
test eax, eax
jne 0x10035472
xor eax, eax
jmp 0x100354e7
push 0x6a04
push 0x5a9d
push 1
lea eax, [ebp - 4]
push eax
call fcn.100352d0
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100354cf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x100354a9
xor eax, eax
jmp 0x100354e7
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100354c2
xor eax, eax
jmp 0x100354e7
lea eax, [ebp - 4]
push eax
push 1
call fcn.10035332
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100354e0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x100354e4
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret