joyce8/EMBER2024-capa huggingface dataset:
Function at 0x541960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
mov eax, esi
mov edx, 0x5dd588
call fcn.0040ece0
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00541950
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 8], 0
mov dword [esi], 0
lea eax, [esi + 0x34]
xor edx, edx
call fcn.00408bd0
mov eax, fcn.004e2c80
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [edi]
lea ecx, [ebp - 4]
xor dx, dx
call fcn.00409520
mov edx, dword [ebp - 4]
lea eax, [esi + 0x30]
call fcn.00408bd0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x10]
lea edx, [esi + 0xc]
mov eax, ebx
call fcn.0053fe30
mov edx, esi
mov eax, ebx
call fcn.00541ef0
test dword [ebx + 0x28], 0x10
jne 0x541a28
mov eax, ebx
call fcn.004ff110
test al, al
jne 0x541a28
or dword [esi + 0x24], 0x8000000
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00541950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5564d0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, eax
xor cl, cl
mov edx, 0x60
call fcn.00403800
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
ret

Function at 0x55f180
Capabilities:
Hash data using murmur3

Disassembly:
xchg ecx, edx
push ebp
push edi
lea ebp, [ecx + edx]
push esi
push ebx
sub esp, 8
cmp edx, 0xf
mov ebx, eax
mov dword [esp], edx
lea eax, [ebx + 0x165667b1]
jbe 0x55f228
lea eax, [ebp - 0x10]
lea edi, [ebx + 0x24234428]
lea esi, [ebx - 0x7a143589]
mov dword [esp + 4], ebp
mov edx, eax
lea eax, [ebx + 0x61c8864f]
mov ebp, edx
mov edx, dword [ecx]
imul edx, edx, 0x85ebca77
add edi, edx
rol edi, 0xd
imul edi, edi, 0x9e3779b1
mov edx, dword [ecx + 4]
imul edx, edx, 0x85ebca77
add esi, edx
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov edx, dword [ecx + 8]
imul edx, edx, 0x85ebca77
add ebx, edx
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
mov edx, dword [ecx + 0xc]
lea ecx, [ecx + 0x10]
imul edx, edx, 0x85ebca77
add eax, edx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp ebp, ecx
jae 0x55f1bd
rol edi, 1
rol esi, 7
rol ebx, 0xc
add esi, edi
mov ebp, dword [esp + 4]
ror eax, 0xe
add ebx, esi
add eax, ebx
lea esi, [ecx + 4]
add eax, dword [esp]
cmp ebp, esi
jb 0x55f25a
mov ebx, esi
nop
imul edx, dword [ebx - 4], 0xc2b2ae3d
add ebx, 4
add eax, edx
ror eax, 0xf
imul eax, eax, 0x27d4eb2f
cmp ebp, ebx
jae 0x55f235
lea edx, [ebp - 4]
sub edx, ecx
mov ecx, edx
and ecx, 0xfffffffc
add ecx, esi
cmp ebp, ecx
jbe 0x55f27a
movzx edx, byte [ecx]
add ecx, 1
imul edx, edx, 0x165667b1
add eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
cmp ebp, ecx
jne 0x55f25e
nop
mov edx, eax
add esp, 8
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
pop ebx
pop esi
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
pop edi
pop ebp
mov edx, eax
shr edx, 0x10
xor eax, edx
ret
Function at 0x560070
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 0x14]
mov dword [esp + 8], eax
mov dword [esp], edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
lea eax, [ecx + edx]
mov dword [esp + 4], eax
cmp dword [esp + 0xc], 0x10
jl 0x56014f
mov edx, dword [esp + 4]
lea ebx, [edx - 0x10]
mov edx, dword [esp + 8]
mov dword [esp + 0x10], edx
sub edx, 0x7a143589
lea eax, [edx - 0x61c8864f]
mov ecx, dword [esp + 0x10]
add ecx, 0x61c8864f
mov edi, dword [esp]
mov esi, dword [edi]
imul esi, esi, 0x85ebca77
add esi, eax
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov eax, esi
mov esi, dword [esp]
mov edi, dword [esi + 4]
imul edi, edi, 0x85ebca77
lea esi, [edi + edx]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov edx, esi
mov edi, dword [esp]
mov esi, dword [edi + 8]
imul esi, esi, 0x85ebca77
add esi, dword [esp + 0x10]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov dword [esp + 0x10], esi
mov esi, dword [esp]
mov edi, dword [esi + 0xc]
imul edi, edi, 0x85ebca77
lea esi, [edi + ecx]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov ecx, esi
add dword [esp], 0x10
cmp ebx, dword [esp]
jae 0x5600c0
mov ebx, eax
rol ebx, 1
mov eax, edx
rol eax, 7
add eax, ebx
mov edx, dword [esp + 0x10]
rol edx, 0xc
add edx, eax
mov eax, ecx
rol eax, 0x12
add edx, eax
jmp 0x560159
mov eax, dword [esp + 8]
lea edx, [eax + 0x165667b1]
add edx, dword [esp + 0xc]
jmp 0x56017e
mov ecx, dword [esp]
mov eax, dword [ecx]
imul eax, eax, 0xc2b2ae3d
add edx, eax
mov eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
mov edx, eax
add dword [esp], 4
mov eax, dword [esp]
lea ecx, [eax + 4]
cmp ecx, dword [esp + 4]
jbe 0x560160
jmp 0x5601af
mov eax, dword [esp]
movzx ecx, byte [eax]
imul ecx, ecx, 0x165667b1
add edx, ecx
mov eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
mov edx, eax
add dword [esp], 1
mov eax, dword [esp + 4]
cmp eax, dword [esp]
ja 0x560190
mov eax, edx
shr eax, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae3d
mov eax, edx
shr eax, 0x10
xor eax, edx
lea esp, [esp + 0x14]
pop edi
pop esi
pop ebx
ret

Function at 0x560260
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov eax, 0xffffffff
nop
add eax, 1
mov edx, eax
xor ebx, ebx
nop
add ebx, 1
mov ecx, edx
and ecx, 1
je 0x560288
mov ecx, edx
shr ecx, 1
xor ecx, 0x82f63b78
mov edx, ecx
jmp 0x56028a
shr edx, 1
cmp ebx, 8
jl 0x560270
mov dword [eax*4 + 0x5f1e50], edx
cmp eax, 0xff
jl 0x560268
mov ecx, 0xffffffff
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x5f1e50]
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov esi, edx
shr esi, 8
movzx eax, dl
xor esi, dword [eax*4 + 0x5f1e50]
mov edx, esi
mov eax, ebx
shl eax, 0xa
mov dword [eax + ecx*4 + 0x5f1e50], edx
cmp ebx, 7
jl 0x5602b8
cmp ecx, 0xff
jl 0x5602a8
pop esi
pop ebx
ret
Function at 0x10012d62
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007037c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10012f17
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10012f09
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0x3fc7
mov dword [ebp - 0x44], 0x100079d8
cmp dword [ebp - 0x28], 0x41e9
jle 0x10012e92
and dword [ebp - 0x18], 0
jmp 0x10012dea
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19ee
jge 0x10012e86
and dword [ebp - 0x1c], 0
jmp 0x10012e04
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5071
jge 0x10012e81
and dword [ebp - 0x20], 0
jmp 0x10012e1a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1875
jge 0x10012e7c
and dword [ebp - 0x24], 0
jmp 0x10012e30
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x2b33
jge 0x10012e7a
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x24]
or eax, ecx
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.1000a83a
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.1000ef04
push eax
call fcn.10057a33
pop ecx
lea ecx, [ebp - 0x70]
call fcn.1000eefa
jmp 0x10012e29
jmp 0x10012e13
jmp 0x10012dfd
jmp 0x10012de3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x3bf3
jge 0x10012eae
push dword [ebp - 0x44]
call fcn.10057a33
pop ecx
jmp 0x10012eca
or dword [ebp - 4], 0xffffffff
jmp 0x10012ed4
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10012eea
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x10012f07
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.1000f21a
mov dword [eax], 8
jmp 0x10012edf
jmp 0x10012f15
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10012f38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
push 0x71ac
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0
call fcn.100153c5
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013132
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001315e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.100133c4
add esp, 0xc
jmp 0x100131bd
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100131a5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
jmp 0x100131bd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100131bd
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x100133f2
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007038e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001343a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10013435
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x100135c8
mov dword [ebp - 0x14], 0xb03e3869
mov dword [ebp - 0x10], 0xffffffff
push 4
lea ecx, [ebp - 0x64]
call fcn.1000f17c
and dword [ebp - 4], 0
mov dword [ebp - 0x48], 0x38d10fbf
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x1001347b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10013494
push dword [ebp - 0x18]
lea ecx, [ebp - 0x64]
call fcn.1000f21a
mov dword [eax], 0x3fd52a42
jmp 0x10013474
imul eax, dword [ebp - 0x14], 0xffffffff
inc eax
jne 0x100134a7
cmp dword [ebp - 0x10], 0
jne 0x100134a7
and dword [ebp - 0x20], 0
jmp 0x100134ae
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jge 0x100134bf
mov dword [ebp - 0x24], 1
jmp 0x100134c3
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x24], eax
jl 0x100134d4
mov dword [ebp - 0x28], 1
jmp 0x100134d8
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x28]
add eax, ecx
add eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
jle 0x100134f7
mov dword [ebp - 0x2c], 1
jmp 0x100134fb
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
jg 0x10013512
mov dword [ebp - 0x1c], 1
jmp 0x10013516
and dword [ebp - 0x1c], 0
push 2
lea ecx, [ebp - 0x64]
call fcn.1000f21a
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
cmp dword [ebp - 0x1c], 0
jne 0x10013540
push 0
lea ecx, [ebp - 0x64]
call fcn.1000f21a
cmp dword [eax], 0
jne 0x10013540
and dword [ebp - 0x40], 0
jmp 0x10013547
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x14], 0
jne 0x10013559
cmp dword [ebp - 0x14], 0
je 0x10013568
push 1
lea ecx, [ebp - 0x64]
call fcn.1000f21a
cmp dword [eax], 0
jne 0x1001356d
xor eax, eax
inc eax
je 0x1001357c
cmp dword [ebp - 0x14], 0
je 0x1001357c
mov dword [ebp - 0x30], 1
jmp 0x10013580
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jle 0x10013594
mov dword [ebp - 0x34], 1
jmp 0x10013598
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x34]
add eax, 4
cmp eax, dword [ebp - 0x10]
je 0x100135ac
mov dword [ebp - 0x44], 1
jmp 0x100135b0
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.1000f1fe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10018cbb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10018d24
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10018cff
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10018cfd
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10018d22
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10018d22
push 0
push 0xeaa
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
jmp 0x10018d4b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0x159f
push 0x6d90
push 0
push 0x64a
push dword [ebp - 0x18]
push 0x15ca
call fcn.100184a6
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x10018d4f
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070504
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10018ed4
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0x34e1
mov dword [ebp - 0x34], 0x10007db8
cmp dword [ebp - 0x28], 0x367e
jle 0x10018e5e
push 0x1f84
push 0
push 0
push 0x2e3
call dword [sym.imp.GDI32.dll_PolyPolygon]
and dword [ebp - 0x18], 0
jmp 0x10018dbf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2b34
jge 0x10018e5e
and dword [ebp - 0x1c], 0
jmp 0x10018dd9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5710
jge 0x10018e59
and dword [ebp - 0x20], 0
jmp 0x10018def
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7604
jge 0x10018e54
and dword [ebp - 0x24], 0
jmp 0x10018e05
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5c00
jge 0x10018e52
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar eax, cl
xor eax, edx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.1000a83a
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000ef04
push eax
call fcn.10057a33
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.1000eefa
jmp 0x10018dfe
jmp 0x10018de8
jmp 0x10018dd2
jmp 0x10018db8
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10018e80
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10018e7e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x10018e96
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x10018e96
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x319e
jge 0x10018eac
push dword [ebp - 0x34]
call fcn.10057a33
pop ecx
jmp 0x10018ec8
or dword [ebp - 4], 0xffffffff
jmp 0x10018ed2
jmp 0x10018ef2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
push 0
mov eax, dword [ebp - 0x38]
push dword [eax]
push dword [ebp - 0x3c]
call fcn.100135d6
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002da30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100709ba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002db53
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x6770
mov dword [ebp - 0x2c], 0x10008700
cmp dword [ebp - 0x24], 0x6a98
jle 0x1002dae8
and dword [ebp - 0x18], 0
jmp 0x1002da88
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3ba8
jge 0x1002dae8
and dword [ebp - 0x1c], 0
jmp 0x1002da9e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x366b
jge 0x1002dae6
and dword [ebp - 0x20], 0
jmp 0x1002dab4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2529
jge 0x1002dae4
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x106177f8
call fcn.1000ef24
jmp 0x1002daad
jmp 0x1002da97
jmp 0x1002da81
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1002db05
mov byte [ebp - 0x11], 0
push 0
lea eax, [ebp - 0x11]
push eax
call fcn.1002de22
pop ecx
pop ecx
jmp 0x1002db11
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x66e1
jge 0x1002db2b
mov edx, dword [ebp - 0x2c]
mov ecx, 0x106177f8
call fcn.100115a3
jmp 0x1002db47
or dword [ebp - 4], 0xffffffff
jmp 0x1002db51
jmp 0x1002db6f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1002dba5
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004f3dc
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007123c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004f437
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1004f427
push 0
push 0
push 0x1962
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x1004f432
push 0x1858
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x1004f557
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1004f52b
mov dword [ebp - 0x24], 0x6cde
mov dword [ebp - 0x30], 0x100090f0
cmp dword [ebp - 0x24], 0x6e63
jle 0x1004f4d3
and dword [ebp - 0x18], 0
jmp 0x1004f475
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x79f7
jge 0x1004f4d3
and dword [ebp - 0x1c], 0
jmp 0x1004f48b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6c4a
jge 0x1004f4d1
and dword [ebp - 0x20], 0
jmp 0x1004f4a1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x75fc
jge 0x1004f4cf
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
xor edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x106177f8
call fcn.1000ef24
jmp 0x1004f49a
jmp 0x1004f484
jmp 0x1004f46e
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6a44
jge 0x1004f4f1
mov edx, dword [ebp - 0x30]
mov ecx, 0x106177f8
call fcn.100115a3
jmp 0x1004f50d
or dword [ebp - 4], 0xffffffff
jmp 0x1004f517
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1004f529
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1004f557
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1004f557
push 1
push 0x4711
push 0
push 0x65e1
call fcn.10048036
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret