joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c3c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1007628e
call fcn.10012e30
nop
mov dword [ebp - 0x14], 0x270
jmp 0x1000c3fd
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4e0
jae 0x1000c472
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 - 0x9bc]
and edx, 0x80000000
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 - 0x9b8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x1000c444
mov dword [ebp - 0xe8], 0x9908b0df
jmp 0x1000c44e
mov dword [ebp - 0xe8], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000c3f4
pop edi
pop esi
pop ebx
add esp, 0xe8
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret
Function at 0x10010810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x58]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10076283
call fcn.10012e30
nop
cmp dword [ebp + 0x10], 0
jg 0x10010852
jl 0x10010849
cmp dword [ebp + 0xc], 0
ja 0x10010852
xor eax, eax
xor edx, edx
jmp 0x1001098b
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10010874
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.100109f0
jmp 0x1001098b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
call fcn.1000b350
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jbe 0x100108e4
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10002150
add esp, 8
mov edx, dword [eax]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000e4b0
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003870
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x3c]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000df10
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x1001097c
mov ecx, dword [ebp - 8]
call fcn.1000c490
nop
mov dword [ebp - 0x48], 0xfff
cmp dword [ebp - 0x14], 0xfff
jbe 0x10010955
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
push 0xfff
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10023cf0
add esp, 0x10
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x54]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x54], 0xfff
je 0x10010953
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
jmp 0x1001098b
jmp 0x10010901
cmp dword [ebp - 0x14], 0
jbe 0x1001097c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10023cf0
add esp, 0x10
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x100109b4]
call fcn.10012da0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x118
cmp ebp, esp
call fcn.10012e00
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100153c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10015570
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1001548d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10073148]
jb 0x1001540a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1007314c]
ja 0x1001540a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100153da
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100193e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10015430
jmp 0x1001548d
cmp dword [ebp - 0x14], 0x10000
jne 0x10015473
cmp dword [ebp - 0x18], 0x10000
jb 0x10015473
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10015466
mov eax, dword [ebp - 8]
jmp 0x1001548f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10015488
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10015570
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100153da
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100154a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.100155a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10015565
mov edx, dword [ebp - 4]
cmp edx, dword [0x10073148]
jb 0x100154e5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1007314c]
ja 0x100154e5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100154b5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100193e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1001550b
jmp 0x10015565
cmp dword [ebp - 0x14], 0x10000
jne 0x1001554e
cmp dword [ebp - 0x18], 0x10000
jb 0x1001554e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10015541
mov eax, dword [ebp - 8]
jmp 0x10015567
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10015560
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.100155a0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100154b5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10016970
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100746e0], eax
je 0x1001698e
mov eax, 0x10dd
jmp 0x10016a6f
mov eax, dword [0x100746f0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10016a0c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100169ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100169ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10015a20
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10013da0
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10016996
mov dword [0x100746f0], 0
call fcn.10016300
mov ecx, dword [0x100746ec]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10016a59
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10013da0
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10016a24
mov dword [0x100746ec], 0
mov dword [0x100746e0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10016f50
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100746e4], 0
je 0x10016f69
mov eax, dword [0x100746e4]
jmp 0x10017009
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10016f7b
xor eax, eax
jmp 0x10017009
push 8
call fcn.10012b00
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10016fd1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10016fba
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10013da0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100746e4], eax
mov dword [0x100746e8], 0
mov eax, dword [ebp - 8]
jmp 0x10017009
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10016feb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10016f9b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100746ec]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100746ec], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001bc10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001c032
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005b184]
call dword [ebp - 8]
jmp 0x1001c03c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x1003b580
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003ae00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003b5b4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005b184]
call dword [ebp - 8]
jmp 0x1003b5ba
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b610
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003ae40
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003b644
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005b184]
call dword [ebp - 8]
jmp 0x1003b64e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b660
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003ae60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003b698
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x1005b184]
call dword [ebp - 8]
jmp 0x1003b6a6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x1003b6b0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003aee0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003b6f0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005b184]
call dword [ebp - 8]
jmp 0x1003b70e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1003b900
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003bca0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1003bcc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10026c60
add esp, 4
or eax, 0xffffffff
jmp 0x1003bcc9
xor eax, eax
pop ebp
ret
Function at 0x1003dd30
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100136e0
mov eax, dword [0x100730c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10074b90]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x1003df08
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x1003de57
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x1003de57
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x1003de35
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x1003ddb9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1003dec1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x1003df28
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x1003df03
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1003df28
jmp 0x1003dd92
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012e70
mov esp, ebp
pop ebp
ret
Function at 0x1003df40
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100136e0
mov eax, dword [0x100730c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10074b90]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x1003e12b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x1003e076
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x1003e076
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x1003e052
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x1003dfc9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1003e0e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1003e14b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x1003e126
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x1003e14b
jmp 0x1003dfa2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012e70
mov esp, ebp
pop ebp
ret
Function at 0x1004b5f0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.1001ea40
lea ecx, [ebp - 4]
call fcn.1004b5c0
movzx eax, al
test eax, eax
jne 0x1004b62d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.1004b500
mov eax, dword [ebp - 0x18]
jmp 0x1004b755
lea ecx, [ebp - 4]
call fcn.1001c590
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1004b580
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.1001c590
push eax
push 0
push 0
call fcn.10048f90
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1004b693
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.1004b500
mov eax, dword [ebp - 0x20]
jmp 0x1004b755
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10021980
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.100125c0
lea ecx, [ebp - 8]
call fcn.10012ab0
movzx edx, al
test edx, edx
jne 0x1004b6dc
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.10012a90
lea ecx, [ebp - 4]
call fcn.1004b500
mov eax, dword [ebp - 0x24]
jmp 0x1004b755
lea ecx, [ebp - 8]
call fcn.10012630
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.1001c590
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.10048f90
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1004b737
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.10012a90
lea ecx, [ebp - 4]
call fcn.1004b500
mov eax, dword [ebp - 0x34]
jmp 0x1004b755
lea ecx, [ebp - 8]
call fcn.10021cc0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.10012a90
lea ecx, [ebp - 4]
call fcn.1004b500
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x40560a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x40e38c], 0
je 0x405622
mov eax, dword [0x40e390]
jmp 0x4056f2
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405671
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x40e390
push esi
push esi
push dword [0x40e120]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405671
cmp dword [ebp - 8], 4
je 0x4056cb
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x405682
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4056d3
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x40e390
push esi
push esi
push dword [0x40e120]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4056d3
cmp dword [ebp - 8], 4
jne 0x4056d3
mov esi, dword [0x40e390]
jmp 0x4056d9
mov dword [0x40e390], esi
cmp dword [ebp - 4], 0
mov byte [0x40e38c], 1
je 0x4056ef
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4056f6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x40a3ec
push Ordinal_1
mov dword [ebp - 8], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405788
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40577e
push 4
pop edi
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push str.InsecureQI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40577e
cmp dword [ebp + 8], edi
jne 0x40577e
mov edi, dword [ebp - 0xc]
cmp edi, 3
ja 0x40577e
cmp dword [ebp - 4], ebx
je 0x40578a
push dword [ebp - 4]
call esi
jmp 0x40578a
cmp dword [ebp - 4], ebx
je 0x405788
push dword [ebp - 4]
call esi
mov edi, ebx
cmp dword [ebp - 8], ebx
je 0x405794
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4