joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401065
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040efd0
mov eax, dword [0x41a034]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push eax
call fcn.00403752
lea eax, [ebp - 0x1004]
push 0x417c2c
push eax
call fcn.00403930
add esp, 0x14
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403668
leave
ret

Function at 0x4018b2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x3e8
push dword [0x41c0a0]
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], 3
mov dword [ebp - 4], 0x640000
call fcn.004033e9
pop ecx
call fcn.004033d0
cmp dword [0x41b07c], 0xffffffff
pop edi
jne 0x401918
xor eax, eax
push eax
push eax
push eax
push 0x403253
push eax
push eax
mov byte [0x41b078], al
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41b07c], eax
leave
ret

Function at 0x402100
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [0x41a034]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x14], 0
and dword [esp + 0x10], 0
push ebx
push edi
mov ebx, ecx
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040191a
pop ecx
lea edi, [esp + 8]
call fcn.004019c1
mov ecx, dword [esp + 0x64]
pop edi
pop ebx
xor ecx, esp
call fcn.00403668
mov esp, ebp
pop ebp
ret
Function at 0x4028d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41a034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0x417c30
push eax
mov byte [ebp - 0x15], 0
call fcn.00405574
xor edi, edi
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x402995
push 2
push edi
push eax
call fcn.0040595c
push dword [ebp - 0x1c]
call fcn.004066c3
push edi
push edi
push dword [ebp - 0x1c]
mov dword [esi], eax
call fcn.0040595c
mov eax, dword [esi]
add esp, 0x1c
cmp eax, edi
jle 0x40298c
push eax
call fcn.00403e25
push dword [ebp - 0x1c]
mov edi, dword [esi]
push edi
push 1
push eax
mov dword [ebp - 0x20], eax
call fcn.004058b5
add esp, 0x14
cmp eax, edi
jne 0x402983
push edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
call fcn.00402100
pop ecx
pop ecx
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x14]
mov edx, eax
shr edx, 4
mov dl, byte [edx + str.0123456789abcdef]
and eax, 0xf
mov byte [ebx + ecx*2], dl
mov al, byte [eax + str.0123456789abcdef]
mov byte [ebx + ecx*2 + 1], al
inc ecx
cmp ecx, 0x10
jl 0x402959
mov byte [ebp - 0x15], 1
push dword [ebp - 0x20]
call fcn.0040560a
pop ecx
push dword [ebp - 0x1c]
call fcn.00405a58
pop ecx
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x15]
xor ecx, ebp
pop edi
call fcn.00403668
leave
ret

Function at 0x403668
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a034]
jne 0x403672
repz ret
jmp fcn.004068e2

Function at 0x403a18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x403a49
call fcn.00406daa
mov dword [eax], esi
call fcn.00406d97
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040622d
add esp, 0x14
push 0x16
pop eax
jmp 0x403a9e
test dword [ebp + 0xc], 0xfffffff9
jne 0x403a25
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x403a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00406dbd
pop ecx
call fcn.00406d97
mov eax, dword [eax]
jmp 0x403a9e
test al, 0x10
jne 0x403a9c
test al, 1
je 0x403a9c
test byte [ebp + 0xc], 2
je 0x403a9c
call fcn.00406daa
mov dword [eax], 5
call fcn.00406d97
mov dword [eax], 0xd
jmp 0x403a6d
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40effb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407ce3
and dword [ebp - 4], 0
cmp dword [0x41bf94], 0
mov ebx, eax
jne 0x40f0ac
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f15d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40f15d
push eax
call fcn.00407c71
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41bf94], eax
call esi
push eax
call fcn.00407c71
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41bf98], eax
call esi
push eax
call fcn.00407c71
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41bf9c], eax
call esi
push eax
call fcn.00407c71
pop ecx
mov dword [0x41bfa4], eax
test eax, eax
je 0x40f0ac
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407c71
pop ecx
mov dword [0x41bfa0], eax
mov eax, dword [0x41bfa0]
cmp eax, ebx
je 0x40f104
cmp dword [0x41bfa4], ebx
je 0x40f104
push eax
call fcn.00407cec
push dword [0x41bfa4]
mov esi, eax
call fcn.00407cec
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f104
test edi, edi
je 0x40f104
call esi
test eax, eax
je 0x40f0fb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f0fb
test byte [ebp - 0xc], 1
jne 0x40f104
or dword [ebp + 0x10], 0x200000
jmp 0x40f13d
mov eax, dword [0x41bf98]
cmp eax, ebx
je 0x40f13d
push eax
call fcn.00407cec
pop ecx
test eax, eax
je 0x40f13d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f13d
mov eax, dword [0x41bf9c]
cmp eax, ebx
je 0x40f13d
push eax
call fcn.00407cec
pop ecx
test eax, eax
je 0x40f13d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41bf94]
call fcn.00407cec
pop ecx
test eax, eax
je 0x40f15d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f15f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aec0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b6a8]
jne 0x40aeca
repz ret
jmp fcn.00411f9c

Function at 0x420eed
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f72b
and dword [ebp - 0x14], 0
cmp dword [0x44e26c], 0
mov dword [ebp - 0x18], eax
jne 0x420fa0
push 0x404348
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x421048
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40433c
push ebx
call edi
test eax, eax
je 0x421048
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40432c
push ebx
mov dword [0x44e26c], eax
call edi
push eax
call esi
push 0x404318
push ebx
mov dword [0x44e270], eax
call edi
push eax
call esi
push 0x4042fc
push ebx
mov dword [0x44e274], eax
call edi
push eax
call esi
mov dword [0x44e27c], eax
test eax, eax
je 0x420fa0
push 0x4042e4
push ebx
call edi
push eax
call esi
mov dword [0x44e278], eax
mov eax, dword [0x44e278]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x420ff9
cmp dword [0x44e27c], ecx
je 0x420ff9
push eax
call esi
push dword [0x44e27c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x420ff9
test ebx, ebx
je 0x420ff9
call edi
test eax, eax
je 0x420ff0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x420ff0
test byte [ebp - 8], 1
jne 0x420ff9
or dword [ebp + 0x10], 0x200000
jmp 0x42102c
mov eax, dword [0x44e270]
cmp eax, dword [ebp - 0x18]
je 0x42102c
push eax
call esi
test eax, eax
je 0x42102c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42102c
mov eax, dword [0x44e274]
cmp eax, dword [ebp - 0x18]
je 0x42102c
push eax
call esi
test eax, eax
je 0x42102c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44e26c]
call esi
test eax, eax
je 0x421048
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42104a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aec0
leave
ret
Function at 0x422c40
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1804
call fcn.00421d20
cmp dword [0x7eef80], 0x37
jne 0x422d0a
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x404520
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x404538
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x4045a0
push 0
lea ecx, [esp + 0x80c]
push ecx
push 0x4045c0
push 0x4045e8
push 0x404608
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x1008]
push eax
push 0x404640
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov ecx, dword [0x7eef84]
mov eax, dword [0x7eb3f0]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1804
ret
Function at 0x401d3a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x801c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040b3d0
mov ecx, 0x7fff
sub esp, eax
xor eax, eax
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x8017]
mov esi, dword [ebp + 0xc]
rep stosb byte es:[edi], al
lea edi, [ebp - 0x8017]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], edi
mov dword [esp], 0x40d088
call sub.kernel32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp + 4], 0x40d0a1
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401daa
mov dword [esp + 4], 0x40d0ad
mov dword [esp], edi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401df8
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00401cc3
test eax, eax
mov dword [0x410a2c], eax
je 0x401e3c
mov dword [esp + 4], 0x40d0b3
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
mov edx, 1
test eax, eax
jne 0x401df2
mov dword [esp + 4], 0x40d0c3
mov dword [esp], edi
call sub.msvcrt.dll_strstr
xor edx, edx
test eax, eax
setne dl
mov dword [0x410024], edx
mov eax, dword [0x410a2c]
test eax, eax
je 0x401e19
mov dword [esp + 8], 0x40d0cd
mov dword [esp + 4], 0x40d0d2
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x410a2c]
test eax, eax
je 0x401e40
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0x40d0e1
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x401e40
xor eax, eax
jmp 0x401e45
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401f36
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, dword [0x410a2c]
test eax, eax
je 0x401f65
mov dword [esp + 8], 0x419168
mov dword [esp + 4], 0x40d124
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
test ebx, ebx
je 0x401ff7
lea eax, [ebp - 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0x1300
call sub.kernel32.dll_FormatMessageA
mov eax, dword [0x410a2c]
sub esp, 0x1c
test eax, eax
je 0x401fc7
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], 0x40d133
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], 0x40d13f
mov dword [esp], 0x419168
call sub.msvcrt.dll_strcat
mov ebx, dword [ebp - 0xc]
mov dword [esp], 0x419168
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call sub.kernel32.dll_LocalFree
push ecx
mov dword [esp], 0x419168
call fcn.00401ed3
cmp byte [0x419568], 0
je 0x402064
mov eax, dword [0x410a2c]
test eax, eax
je 0x40202d
mov dword [esp + 8], 0x419568
mov dword [esp + 4], 0x40d142
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x419568
mov dword [esp + 4], 0x40d150
mov dword [esp], 0
call sub.shell32.dll_ShellExecuteA
sub esp, 0x18
call fcn.00401d21
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40206e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
cmp dword [0x410024], 0
mov ebx, dword [ebp + 0xc]
je 0x4020a2
mov eax, dword [0x410a2c]
test eax, eax
je 0x4020a2
mov dword [esp + 8], esi
mov dword [esp + 4], 0x40d155
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x4190e4]
movzx esi, si
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], esi
mov dword [esp + 4], 0xa
mov dword [esp], eax
call sub.kernel32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x40212b
mov dword [esp + 4], eax
mov eax, dword [0x4190e4]
mov dword [esp], eax
call sub.kernel32.dll_LoadResource
test eax, eax
push ecx
push ecx
je 0x40213b
mov dword [esp], eax
call sub.kernel32.dll_LockResource
test eax, eax
push edx
je 0x40213b
xor edx, edx
mov cl, byte [eax + edx]
mov byte [ebx + edx], cl
inc edx
test cl, cl
jne 0x4020f3
cmp dword [0x410024], 0
mov esi, 1
je 0x40215f
mov eax, dword [0x410a2c]
test eax, eax
je 0x40215f
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x40d163
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x40215f
mov dword [esp], 0
call sub.kernel32.dll_SetLastError
push esi
mov byte [ebx], 0
xor esi, esi
cmp dword [0x410024], 0
je 0x40215f
mov eax, dword [0x410a2c]
test eax, eax
je 0x40215f
mov dword [esp + 4], eax
mov dword [esp], 0x40d167
call sub.msvcrt.dll_fputs
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
Function at 0x4021de
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], 0x40d174
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x40225b
mov dword [esp + 4], 0x40d186
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402262
mov dword [esp + 4], 0x40d198
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402269
mov dword [esp + 4], 0x40d1ab
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402270
mov dword [esp + 4], 0x40d1b6
xor esi, esi
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
jne 0x40234c
mov esi, 0x80000005
jmp 0x402275
mov esi, 0x80000000
jmp 0x402275
mov esi, 0x80000001
jmp 0x402275
mov esi, 0x80000002
jmp 0x402275
mov esi, 0x80000003
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_strchr
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
lea edi, [eax + 1]
call sub.msvcrt.dll_strrchr
lea edx, [ebp - 0x20]
mov byte [eax], 0
mov ebx, eax
cmp dword [0x41001c], 0
jne 0x4022d4
mov dword [esp], esi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], edi
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x402349
jmp 0x402301
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [ebp - 0x2c], edx
call sub.advapi32.dll_RegOpenKeyExA
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
jne 0x4022a9
lea eax, [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
lea eax, [ebx + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
sete al
movzx eax, al
mov esi, eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push edi
mov byte [ebx], 0x5c
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40293e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x41
push edi
push esi
push ebx
sub esp, 0x24c
mov edx, dword [ebp + 0xc]
lea edi, [ebp - 0x220]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x220]
and edx, 0x100
or edx, 0x20019
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x402a38
lea edi, [ebp - 0x11c]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x228]
xor ebx, ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x224]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x22c]
lea edi, [ebp - 0x11c]
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40d26e
mov dword [esp], eax
mov dword [ebp - 0x228], 0x104
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x402a13
mov dl, byte [edi + eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x4029fe
mov dword [esp], esi
call fcn.00402657
mov ebx, eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
test ebx, ebx
push eax
je 0x402a38
mov dword [esp + 4], esi
mov dword [esp], 0x418edc
call sub.msvcrt.dll_strcpy
jmp 0x402a44
mov dword [0x418c58], 1
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402e1f
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov dword [ebp - 0x48], 0x40
call sub.kernel32.dll_GlobalMemoryStatusEx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp], ebx
mov dword [esp + 0x14], 0x40d33f
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 0x19
call fcn.00402cce
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [esp], ebx
mov dword [esp + 0x14], 0x40d344
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0x1b
call fcn.00402cce
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x402e9d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov eax, dword [ebp + 8]
mov dword [esp], 0xc
mov ebx, dword [ebp + 0xc]
mov dword [esp + 4], eax
call fcn.0040206e
test eax, eax
je 0x402ed6
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x40d349
mov dword [esp], eax
call sub.msvcrt.dll_strcat
xor eax, eax
mov ecx, 0x41
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x11c]
mov dword [esp], ebx
not ecx
sub ecx, 4
mov dword [esp + 8], ecx
call sub.msvcrt.dll_strncpy
mov dword [esp + 4], 0x40d34b
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll__open
mov dword [ebp - 0x12c], eax
inc eax
je 0x402ff6
mov eax, dword [0x410a2c]
test eax, eax
je 0x402f51
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x40d353
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edi, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
xor ebx, ebx
mov esi, 1
repne scasb al, byte es:[edi]
mov eax, 0x7c00
mov edi, dword [ebp + 8]
not ecx
dec ecx
sub eax, ecx
add edi, ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov edx, edi
cmp ebx, eax
jge 0x402fc8
mov cl, byte [edi + ebx]
cmp cl, 0x23
je 0x402fc3
cmp cl, 0xa
je 0x402f9f
cmp cl, 0xd
jne 0x402fb5
cmp edx, dword [ebp + 8]
mov esi, 1
jbe 0x402fc5
cmp byte [edx - 1], 0x20
je 0x402fc5
mov byte [edx], 0x20
inc edx
jmp 0x402fc5
test esi, esi
je 0x402fc5
mov byte [edx], cl
mov esi, 1
inc edx
jmp 0x402fc5
xor esi, esi
inc ebx
jmp 0x402f89
test eax, eax
mov byte [edx], 0
jle 0x402fe8
cmp byte [edx - 1], 0x20
je 0x402fe8
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x40d349
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll__close
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403001
Capabilities:
Check mutex on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x20
push edi
lea edi, [ebp - 0x88]
sub esp, 0xa4
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x88]
mov dword [esp + 4], edi
mov dword [esp], 0x17
call fcn.0040206e
mov edx, 1
cmp byte [ebp - 0x88], 0
je 0x4030ce
mov eax, dword [0x410a2c]
test eax, eax
je 0x40305f
mov dword [esp + 8], edi
mov dword [esp + 4], 0x40d360
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x94]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x94], 0xc
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x90], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
call sub.kernel32.dll_GetLastError
mov edx, 1
cmp eax, 0xb7
jne 0x4030ce
mov eax, dword [0x410a2c]
test eax, eax
je 0x4030cc
mov dword [esp + 8], 0x40d372
mov dword [esp + 4], 0x40d133
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
xor edx, edx
mov eax, edx
mov edi, dword [ebp - 4]
leave
ret

Function at 0x4032b9
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov eax, 0x801c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040b3d0
xor esi, esi
mov ecx, 0x7fff
sub esp, eax
mov eax, esi
lea edi, [ebp - 0x8017]
rep stosb byte es:[edi], al
lea ebx, [ebp - 0x8017]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], ebx
mov dword [esp], 0x40d3ac
call sub.kernel32.dll_GetEnvironmentVariableA
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
mov edx, eax
mov eax, esi
repne scasb al, byte es:[edi]
mov esi, 0x7ffe
sub esp, 0xc
sub esi, edx
xor eax, eax
not ecx
dec ecx
cmp esi, ecx
jb 0x40334a
mov dword [esp + 4], 0x40d277
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], ebx
mov dword [esp], 0x40d3ac
call sub.kernel32.dll_SetEnvironmentVariableA
push esi
push esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret