joyce8/EMBER2024-capa huggingface dataset:
Function at 0x505990
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.0058ee00
mov eax, dword [0x6204e0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push edi
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x505a0d
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x34]
push ecx
push 0x40
push edx
call edi
test eax, eax
je 0x505a04
mov eax, 8
call fcn.0058ee00
fld qword [0x5d3968]
fstp qword [esp]
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.004c00b0
add esp, 0x10
mov ecx, dword [esp + 0xc]
push 0
push ecx
call ebx
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea edx, [esp + 0x1c]
push edx
call esi
test eax, eax
je 0x505a63
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x34]
push eax
push 0x40
push ecx
call edi
test eax, eax
je 0x505a5a
mov eax, 8
call fcn.0058ee00
fld qword [0x5d3968]
fstp qword [esp]
lea edx, [esp + 0x3c]
push 0x40
push edx
call fcn.004c00b0
add esp, 0x10
mov eax, dword [esp + 0xc]
push 0
push eax
call ebx
call fcn.00505910
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.0058ee00
fld1
fstp qword [esp]
lea edx, [esp + 0x1c]
push 0x20
push edx
call fcn.004c00b0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x10], eax
mov eax, 8
call fcn.0058ee00
fld1
fstp qword [esp]
lea eax, [esp + 0x18]
push 4
push eax
call fcn.004c00b0
mov ecx, dword [esp + 0x84]
add esp, 0x10
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0058ecc6
add esp, 0x6c
ret

Function at 0x5071a0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.0058ee00
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x5071ba
xor eax, eax
pop edi
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x50725e
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x50722a
mov eax, dword [ebx + 8]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
call fcn.004d5110
add esp, 8
test eax, eax
jne 0x50724b
mov ecx, 0x5d3e9c
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x507214
test dl, dl
je 0x507210
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x507214
add eax, 2
add ecx, 2
test dl, dl
jne 0x5071f4
xor eax, eax
jmp 0x507219
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50722a
push edi
call sub.MSVCR90.dll_getenv
add esp, 4
test eax, eax
jne 0x50724e
mov eax, dword [ebx + 8]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], edi
call fcn.004d5110
add esp, 8
test eax, eax
je 0x507255
mov eax, dword [eax + 8]
pop esi
pop ebx
pop edi
add esp, 0xc
ret
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0xc
ret
push edi
call sub.MSVCR90.dll_getenv
add esp, 4
pop ebx
pop edi
add esp, 0xc
ret
Function at 0x5134f0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x5135d3
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x51356e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x5135c0
shl edx, 0x10
cmp edi, 2
jne 0x51357f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x5135ad
lea edx, [edi + 0x3c]
jmp 0x5135ba
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x513510
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x519d20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.0058ee00
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.004c9a70
add esp, 8
test eax, eax
jne 0x519d5b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x519dbd
xor ebx, ebx
test ebp, ebp
jle 0x519f20
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x519d9f
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x519d78
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x519d70
jmp 0x519f20
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
cmp dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jle 0x519f20
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
cmp edi, esi
mov dword [esp + 0x20], esi
jle 0x519efc
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x519e90
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
jl 0x519e60
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
push eax
mov dword [eax + 4], ecx
call fcn.004c9610
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x5227b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.0058ee00
mov eax, dword [0x6204e0]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x522813
cmp ebx, dword [esi]
je 0x52280a
test edi, edi
je 0x5228a0
cmp dword [esp + 0xa0], eax
jl 0x5228a0
mov eax, 1
mov dword [esi], ebx
jmp 0x52281d
mov ebx, dword [esi]
test ebx, ebx
je 0x5228a0
test edi, edi
je 0x5228fe
push ebp
push ebx
call fcn.004caa70
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x52284d
push 0x28
push str.....openssl_1.1.0fcryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.004da870
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
pop ebp
jge 0x5228ba
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 4]
push ecx
push ebx
push edx
call fcn.004cdab0
add esp, 0xc
test eax, eax
je 0x5228a0
mov eax, dword [esp + 0xa0]
mov ecx, dword [esi + 4]
push eax
push edi
push ecx
call fcn.004cdc60
add esp, 0xc
test eax, eax
je 0x5228a0
mov eax, dword [esi + 4]
lea edi, [esi + 0x10]
push edi
lea edx, [esi + 0x14]
push edx
push eax
call fcn.004cdc70
add esp, 0xc
test eax, eax
jne 0x5228db
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0058ecc6
add esp, 0x88
ret
cmp eax, 0x80
ja 0x5228a0
push eax
lea ecx, [esi + 0x14]
push edi
push ecx
call sub.MSVCR90.dll_memcpy
mov edx, dword [esp + 0xac]
lea edi, [esi + 0x10]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x522906
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x14]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
jmp 0x522906
test eax, eax
je 0x5229a9
xor eax, eax
jmp 0x522910
mov dl, byte [esi + eax + 0x14]
xor dl, 0x36
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x80
jl 0x522910
mov edi, dword [esp + 0xc]
mov eax, dword [esi + 8]
push edi
push ebx
push eax
call fcn.004cdab0
add esp, 0xc
test eax, eax
je 0x5228a0
push ebx
call fcn.004caa70
mov edx, dword [esi + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.004cdc60
add esp, 0x10
test eax, eax
je 0x5228a0
xor eax, eax
nop
mov cl, byte [esi + eax + 0x14]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x522960
mov edx, dword [esi + 0xc]
push edi
push ebx
push edx
call fcn.004cdab0
add esp, 0xc
test eax, eax
je 0x5228a0
push ebx
call fcn.004caa70
mov ecx, dword [esi + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.004cdc60
add esp, 0x10
test eax, eax
je 0x5228a0
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push edx
push eax
call fcn.004cdcf0
add esp, 8
test eax, eax
je 0x5228a0
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0058ecc6
add esp, 0x88
ret
Function at 0x557a67
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0058ee00
mov eax, dword [0x6204e0]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x557bd4
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.004d15c0
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.004d16c0
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004fda70
push ebp
call fcn.004d15c0
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.004d16c0
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.004fda70
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x557a83
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.0058ecc6
add esp, 0xa0
ret
Function at 0x58dfaf
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x623888], 0
push esi
jne 0x58df22
call fcn.0058de48
test eax, eax
je 0x58df65
mov eax, dword [0x623888]
cmp eax, 1
jne 0x58df43
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x58df65
pop esi
ret
push eax
call dword [0x623890]
test eax, eax
jne 0x58dfad
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x58df69
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x623888]
call dword [0x623890]
mov edi, eax
test edi, edi
je 0x58df8e
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x58dfaa
mov edi, esi
add esi, 0xff0
push edi
push dword [0x623888]
call dword [0x62388c]
add edi, 0x10
cmp edi, esi
jb 0x58df96
mov eax, edi
pop edi
pop esi
ret
jmp 0x58df0f

Function at 0x58ecc6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6204e0]
jne 0x58ecd0
repz ret
jmp fcn.0058fa80
Function at 0x403690
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040ea20
mov eax, dword [0x2ba0be4]
mov ecx, dword [0x2ba0b58]
shr eax, 3
test eax, eax
jbe 0x4037cb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x4036e0
cmp dword [0x2ba0be4], 0x959
jne 0x4037ad
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0x402d88
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1020]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0x402da8
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x824]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0x402dec
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0x402df4
push 0x402e0c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004034c0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4036e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret
Function at 0x40617b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x446aa8]
jne 0x406185
repz ret
jmp fcn.0040a77c

Function at 0x40ce4b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407ade
and dword [ebp - 4], 0
cmp dword [0x44a0d8], 0
mov ebx, eax
jne 0x40cefc
push 0x402c94
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40cfad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c88
push edi
call esi
test eax, eax
je 0x40cfad
push eax
call fcn.00407a6c
mov dword [esp], 0x402c78
push edi
mov dword [0x44a0d8], eax
call esi
push eax
call fcn.00407a6c
mov dword [esp], 0x402c64
push edi
mov dword [0x44a0dc], eax
call esi
push eax
call fcn.00407a6c
mov dword [esp], 0x402c48
push edi
mov dword [0x44a0e0], eax
call esi
push eax
call fcn.00407a6c
pop ecx
mov dword [0x44a0e8], eax
test eax, eax
je 0x40cefc
push 0x402c30
push edi
call esi
push eax
call fcn.00407a6c
pop ecx
mov dword [0x44a0e4], eax
mov eax, dword [0x44a0e4]
cmp eax, ebx
je 0x40cf54
cmp dword [0x44a0e8], ebx
je 0x40cf54
push eax
call fcn.00407ae7
push dword [0x44a0e8]
mov esi, eax
call fcn.00407ae7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40cf54
test edi, edi
je 0x40cf54
call esi
test eax, eax
je 0x40cf4b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40cf4b
test byte [ebp - 0xc], 1
jne 0x40cf54
or dword [ebp + 0x10], 0x200000
jmp 0x40cf8d
mov eax, dword [0x44a0dc]
cmp eax, ebx
je 0x40cf8d
push eax
call fcn.00407ae7
pop ecx
test eax, eax
je 0x40cf8d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40cf8d
mov eax, dword [0x44a0e0]
cmp eax, ebx
je 0x40cf8d
push eax
call fcn.00407ae7
pop ecx
test eax, eax
je 0x40cf8d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44a0d8]
call fcn.00407ae7
pop ecx
test eax, eax
je 0x40cfad
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40cfaf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401940
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x45317f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004089f6
mov eax, dword [esi + 0xd8]
add esi, 0xd4
lea edx, [esp + 4]
mov dword [esp + 0x34], 1
mov ecx, dword [eax*4 + 0x46f13c]
push ecx
push esi
push edx
call fcn.00429d71
mov eax, dword [esp + 4]
push 0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 2
call fcn.00408ab9
test eax, eax
jne 0x4019b8
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ecx
lea edx, [esp + 8]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call fcn.00429851
lea eax, [esp + 0xc]
push eax
call fcn.00404db0
add esp, 8
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x38], 3
call fcn.00429c15
lea ecx, [esp + 8]
mov byte [esp + 0x34], 2
call fcn.00429adc
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00429851
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x34], 1
call fcn.00429adc
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call fcn.00408a33
mov ecx, dword [esp + 0x2c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x34
ret 4

Function at 0x404a80
Capabilities:
Get common file path
Get startup folder

Disassembly:
sub esp, 0x130
lea eax, [esp]
mov dword [esp], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jge 0x404aa6
xor eax, eax
add esp, 0x130
ret
push esi
lea ecx, [esp + 8]
push edi
push ecx
push 0
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x18]
mov edx, dword [esp + 0x13c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x144]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov eax, dword [edi]
mov edx, dword [esp + 0x140]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x148]
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], edx
test eax, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0x31
mov dword [esp + 0x28], 0x404b90
je 0x404b22
mov dword [esp + 0x24], 0x71
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov ecx, dword [esp + 0xc]
mov esi, eax
mov eax, dword [esp + 8]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
test esi, esi
mov byte [esp + 0x10], 0
je 0x404b73
lea edx, [esp + 0x34]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jl 0x404b68
lea eax, [esp + 0x34]
mov ecx, edi
push eax
mov byte [esp + 0x14], 1
call fcn.00429c65
mov eax, dword [esp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
pop edi
and eax, 0xff
pop esi
add esp, 0x130
ret