joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033d0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov eax, 0x1001c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040b3d0
mov ecx, 0x2000
sub esp, eax
xor eax, eax
lea edi, [ebp - 0x8018]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10017]
lea ebx, [ebp - 0x10017]
mov cx, 0x7fff
rep stosb byte es:[edi], al
mov dword [esp + 4], ebx
mov dword [esp], 0x13
call fcn.0040206e
mov dword [esp], ebx
lea ebx, [ebp - 0x8018]
mov dword [esp + 4], 0x40d3ce
call sub.msvcrt.dll_strtok
mov esi, eax
test esi, esi
je 0x4034ab
mov dword [esp + 4], 0x3d
mov dword [esp], esi
call sub.msvcrt.dll_strchr
mov edx, dword [ebp + 0xc]
mov byte [eax], 0
inc eax
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov byte [ebp - 0x8018], 0
mov dword [esp + 8], edx
call fcn.00402a7b
mov eax, dword [0x410a2c]
test eax, eax
je 0x403485
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0x40d3d0
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.kernel32.dll_SetEnvironmentVariableA
push edi
push edi
mov dword [esp + 4], 0x40d3ce
mov dword [esp], 0
call sub.msvcrt.dll_strtok
mov esi, eax
jmp 0x40342b
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403a11
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov eax, 0x808c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040b3d0
mov edx, 0x418c38
mov ecx, 4
mov edi, edx
sub esp, eax
xor eax, eax
mov esi, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
lea ebx, [ebp - 0x805c]
mov edi, ebx
mov cl, 0x11
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x8018]
mov dword [ebp - 0x805c], 0x44
mov cx, 0x2000
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x8018]
mov dword [esp + 4], 0x40d451
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x410b34
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x40d447
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x410c38
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov eax, dword [0x418c48]
mov dword [esp + 0x24], 0x418c38
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.kernel32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x403b36
cmp dword [ebp + 8], 0
je 0x403b29
mov eax, dword [0x418c38]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.kernel32.dll_WaitForSingleObject
push eax
push eax
mov eax, dword [0x418c38]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.kernel32.dll_GetExitCodeProcess
push eax
push eax
call fcn.004039ed
jmp 0x403b2f
mov dword [esi], 0
mov eax, 1
jmp 0x403b3e
mov dword [esi], 0xffffffff
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403b64
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ecx, 0x100
mov ebp, esp
xor eax, eax
push edi
push esi
mov esi, 0x400
push ebx
lea edi, [ebp - 0x418]
sub esp, 0x43c
lea ebx, [ebp - 0x41c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x418]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.kernel32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x403bc6
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x403bc6
add edi, eax
sub esi, eax
jne 0x403b90
cmp dword [0x410024], 0
lea ebx, [ebp - 0x418]
je 0x403bf2
mov eax, dword [0x410a2c]
test eax, eax
je 0x403bf2
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x40d45a
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov dword [esp + 4], 0x22
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x403c26
mov eax, dword [0x410a2c]
test eax, eax
je 0x403cb8
mov dword [esp + 4], eax
mov dword [esp], 0x40d473
jmp 0x403c6e
lea esi, [eax + 1]
mov dword [esp + 4], 0x22
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x403c53
mov eax, dword [0x410a2c]
test eax, eax
je 0x403cb8
mov dword [esp + 4], eax
mov dword [esp], 0x40d4a1
jmp 0x403c6e
sub eax, esi
cmp eax, dword [ebp + 0x10]
jb 0x403c75
mov eax, dword [0x410a2c]
test eax, eax
je 0x403cb8
mov dword [esp + 4], eax
mov dword [esp], 0x40d4cf
call sub.msvcrt.dll_fputs
jmp 0x403cb8
mov edi, dword [ebp + 0xc]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax], 0
mov dword [esp + 4], 0x40d4fa
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
mov edx, 1
test eax, eax
jne 0x403cb3
mov dword [esp + 4], 0x40d501
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
xor edx, edx
test eax, eax
setne dl
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 4
push edi
push esi
lea edx, [ebp - 0x6c]
push ebx
mov edi, edx
sub esp, 0x9c
mov ebx, dword [ebp + 8]
rep stosd dword es:[edi], eax
lea esi, [ebp - 0x5c]
mov edi, esi
cmp dword [0x410024], 0
mov cl, 0x11
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 0x100
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
je 0x403d29
mov eax, dword [0x410a2c]
test eax, eax
je 0x403d29
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x40d508
mov dword [esp], eax
mov dword [ebp - 0x7c], edx
call sub.msvcrt.dll_fprintf
mov edx, dword [ebp - 0x7c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.kernel32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
mov esi, eax
jne 0x403d99
mov eax, dword [0x410a2c]
test eax, eax
je 0x403db1
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x40d51c
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x403db1
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push edx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403e88
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x35c
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x410a2c]
and ebx, 0x100
test edx, edx
je 0x403ed1
mov esi, dword [ebp + 8]
mov eax, 0x40d540
test ebx, ebx
mov ecx, 0x40d543
cmove eax, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0x40d568
mov dword [esp], edx
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x334]
mov dword [esp + 0x10], eax
mov eax, ebx
or eax, 0x20019
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x404090
lea edi, [ebp - 0x324]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x220]
mov dword [ebp - 0x330], 0x104
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edx, [eax + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x334]
lea esi, [ebp - 0x32c]
mov dword [ebp - 0x33c], edx
lea edi, [ebp - 0x220]
lea edx, [ebp - 0x330]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.advapi32.dll_RegEnumKeyExA
sub esp, 0x20
test eax, eax
jne 0x404081
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x324]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004025e6
mov eax, dword [0x410a2c]
test eax, eax
je 0x403fd1
mov dword [esp + 8], esi
mov dword [esp + 4], 0x40d57e
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x220]
lea edi, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004023b8
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00403dc7
test eax, eax
je 0x404049
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call fcn.0040293e
test eax, eax
je 0x404049
mov dword [esp + 4], edi
mov dword [esp], 0x418e5c
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp + 0xc]
mov dword [0x418c4c], eax
mov eax, dword [0x410a2c]
test eax, eax
je 0x404081
mov dword [esp + 8], edi
mov dword [esp + 4], 0x40d58a
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x404081
mov eax, dword [0x410a2c]
test eax, eax
je 0x40406c
lea edx, [ebp - 0x11c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x40d596
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [ebp - 0x330], 0x104
mov eax, dword [ebp - 0x33c]
jmp 0x403f37
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40425d
Capabilities:
Create pipe

Disassembly:
push ebp
mov eax, 0x824c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040b3d0
sub esp, eax
mov esi, dword [ebp + 8]
cmp dword [0x410024], 0
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x8230], 0
mov dword [ebp - 0x822c], 0
je 0x4042bf
mov eax, dword [0x410a2c]
test eax, eax
je 0x4042bf
mov dword [esp + 0x10], 0x418ddc
mov dword [esp + 0xc], 0x418d5c
mov dword [esp + 8], esi
mov dword [esp + 4], 0x40d6d8
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x8228]
mov dword [esp + 8], eax
lea eax, [ebp - 0x822c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8230]
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [ebp - 0x8228], 0xc
mov dword [ebp - 0x8220], 1
mov dword [ebp - 0x8224], 0
call sub.kernel32.dll_CreatePipe
sub esp, 0x10
test eax, eax
jne 0x40432e
mov eax, dword [0x410a2c]
test eax, eax
je 0x404327
mov dword [esp + 4], eax
mov dword [esp], 0x40d6fe
call sub.msvcrt.dll_fputs
xor eax, eax
jmp 0x404497
mov eax, dword [ebp - 0x8230]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.kernel32.dll_SetHandleInformation
sub esp, 0xc
test eax, eax
jne 0x404386
mov eax, dword [0x410a2c]
test eax, eax
je 0x40436c
mov dword [esp + 4], eax
mov dword [esp], 0x40d712
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x822c]
jmp 0x404410
xor eax, eax
mov ecx, 0x2000
lea edi, [ebp - 0x8018]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x811c]
mov cl, 0x41
rep stosd dword es:[edi], eax
mov dword [esp + 4], esi
lea esi, [ebp - 0x811c]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call fcn.00402629
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x8018]
mov dword [esp + 8], 0x40d731
mov dword [esp + 4], 0x8000
mov dword [esp], esi
call fcn.00405f50
mov eax, dword [ebp - 0x822c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00403cc0
test eax, eax
jne 0x40441e
mov eax, dword [0x410a2c]
test eax, eax
je 0x40440a
mov dword [esp + 4], eax
mov dword [esp], 0x40d73f
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
jmp 0x404327
xor eax, eax
mov ecx, 0x20
lea edi, [ebp - 0x821c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x819c]
lea esi, [ebp - 0x821c]
mov cl, 0x20
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x8230]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00403b64
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x821c], 0
push edi
lea edi, [ebp - 0x819c]
je 0x404327
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.004023b8
mov eax, dword [ebx]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00403dc7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404cc0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], 0x40d878
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x404d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x404ddb
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x404d61
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x404d49
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x40]
cmp ecx, 4
je 0x404d59
cmp ecx, 0x40
je 0x404d59
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], 0x40d890
call fcn.00404cc0
lea esi, [esi]
lea edi, [edi]
Function at 0x40ba30
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00405060
call sub.kernel32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ba66
jmp 0x40baa5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40ba63
cmp al, 0x20
je 0x40ba63
cmp al, 0x22
jne 0x40ba89
jmp 0x40baf4
cmp al, 0x20
lea esi, [esi]
je 0x40ba90
test al, al
je 0x40baa5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x40ba77
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x40bb0a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40ba97
cmp al, 0x20
je 0x40ba97
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40bab4
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401803
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x40bafe
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x40baf0
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x40ba90
cmp al, 9
je 0x40ba97
jmp 0x40baa5

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x675d7ffc
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4735464d
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x710426f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x3c]
lea esi, [ebp - 0x38]
push ebx
sub esp, 0x4c
mov dword [ebp - 0x3c], 0x10
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
test eax, eax
je 0x71042760
movzx eax, word [ebp - 0x38]
test ax, ax
je 0x71042747
mov ebx, dword [sym.imp.ucrtbase.dll_towupper]
mov edi, esi
lea esi, [esi]
nop
movzx eax, ax
add edi, 2
mov dword [esp], eax
call ebx
mov word [edi - 2], ax
movzx eax, word [edi]
test ax, ax
jne 0x71042730
mov dword [esp], esi
call dword [sym.imp.oleaut32.dll_SysAllocString]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x71044e40
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], eax
movzx ecx, word [edx]
test esi, esi
je 0x71044fb0
mov eax, dword [ebp + 8]
test eax, eax
je 0x71044f20
test cx, cx
je 0x71044fa0
mov ebx, edx
nop
add ebx, 2
cmp word [ebx], 0
jne 0x71044e70
sub ebx, edx
sar ebx, 1
cmp word [esi], 0
je 0x71044e97
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x71044e88
sub eax, esi
sar eax, 1
add ebx, eax
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x71044eb0
add eax, 2
cmp word [eax], 0
jne 0x71044ea0
sub eax, dword [ebp + 8]
sar eax, 1
add ebx, eax
add ebx, 0x4a
mov dword [ebp - 0x20], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x20]
test eax, eax
mov edi, eax
je 0x7104501a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s_AND_Name_s
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym._swprintf_2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._exec_query
mov dword [esp], edi
mov ebx, eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x71044fb0
test cx, cx
je 0x71045007
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x71044f38
sub eax, edx
sar eax, 1
cmp word [esi], 0
je 0x71044f5f
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x71044f50
sub ecx, esi
sar ecx, 1
add eax, ecx
lea ebx, [eax + 0x3c]
mov dword [ebp - 0x20], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x7104501a
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._swprintf_2
jmp 0x71044ef2
xor ebx, ebx
jmp 0x71044e7d
mov eax, edx
test cx, cx
je 0x7104500e
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x71044fc0
sub eax, edx
mov ebx, eax
add eax, 0x58
sar ebx, 1
add ebx, 0x2c
mov dword [ebp - 0x20], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x7104501a
mov edx, dword [ebp - 0x20]
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._swprintf_2
jmp 0x71044ef2
xor eax, eax
jmp 0x71044f45
mov eax, 0x58
mov ebx, 0x2c
jmp 0x71044fd5
mov ebx, 0x8007000e
jmp 0x71044f13
Function at 0x71045060
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x71060910]
test eax, eax
je 0x71045118
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x710450a0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x7104508c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x7104514d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x71060910], eax
sub esp, 8
test eax, eax
jne 0x7104507d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x7104508e
Function at 0x71048030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x71048088
cmp byte [esi + ebx - 1], 0xa
je 0x7104805c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x71060924], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret