joyce8/EMBER2024-capa huggingface dataset:
Function at 0x790b6f22
Capabilities:
Packed with generic packer

Disassembly:
cmc
bt esp, esi
pushal
test eax, eax
pushfd
lea esp, [esp + 0x2c]
jne 0x7915d4b6
cdq
xchg si, dx
rdtsc
cdq
popal
call fcn.7908228a
rcl byte [edi + edx*8 + 0x7b]
in al, 0x2f
push esi
sub bl, cl
sal dword cs:[0xb11de306], 0xe4
push ebx
push esp
lodsd eax, dword [esi]
mov cl, 0xe6
les eax, [ecx + 0x2044f63e]
mov bl, 0x27
mov word [edi], fs
pushfd
imul eax, dword [eax + 0x46], 0x4c
add eax, 0x38e3e5e1
mov edi, 0x70150ac
lahf
pop esp
jno 0x790b6fd6
inc edx
je 0x790b6f34
sub al, 0x3c
mov dword [ebx], ebx
idiv ebx
adc eax, 0x9ad67d0e
out 0x18, al
and byte [edx + ecx*4], 0xc5
push ds
sbb byte [edx + 0x1ec58a24], al
aas
cwde
test al, 0x24
adc ch, byte [ebp - 0x42]
mov al, 0xcf
cmp byte [edi - 0x54], dl
mov al, 0x79
xor byte [ebx + 0x37], dl
mov ch, byte [ebx]
pushal
xor al, 0x4f
cmp al, 0x67
in al, dx
nop
imul esi, edx, 0x4535dc6d
mov dh, 0x8b
push ds
invalid
wait
loop 0x790b6ff1
sub dh, bl
test byte [edi + 0x6fcdbde8], al
cmp edx, dword [ebx]
jg 0x790b7030
daa
adc edi, esi
ret
push ecx
sub eax, 0x4bae531
cmpsb byte [esi], byte es:[edi]
push 0xffffffffffffffcb
xor ah, bh
fcomp st(4)
dec ebp
dec edx
xchg esp, eax
xchg ecx, eax
cmp bl, byte [edi]
je 0x790b6f84
cmc
pop edx
cmc
retf 0x368e
fcomp st(3)
mov al, 0x37
loop 0x790b6fe5
cwde
pushal
js 0x790b6feb
push 0x4a
out dx, eax
imul ebp, dword [ebx + 0x47], 0x47
xor al, 0xf1
fsubr qword [eax - 0x5950eb9c]
cmpsb byte [esi], byte es:[edi]
adc byte [edx + 0x41a42c2b], 0x87
rcr byte [edi], cl
cmp al, byte [ebx - 0x54340927]
inc esi
pop ecx
sbb esi, ecx
jle 0x790b70b2
xor dh, dl
stc
loop 0x790b705d
fisttp word [di - 0x61]
and byte [ebp + 0xd], bh
or al, 0x39
cmp byte [edx], dh
test byte [esi + edx*8 - 0x7a], ah
stosd dword es:[edi], eax
xor byte [ecx + 0x22], ch
shr byte [ebp + 0x54], cl
out dx, eax
les esp, [ecx + edi*2 - 0x764b4792]
imul esp, edi, 0x603d517
or dword [ecx + 0x370b5ee], 0xffffff85
in al, 0xf9
xor eax, 0x9ba1dd74
adc dword [ebx - 0x21], ebp
mov bh, 0x97
mov esp, 0xb0d84b81
sub eax, dword [esp + eax]
sbb al, 0x75
push ebp
test dword [ebx], edi
xchg dword [edx - 0x72], esi
inc ebp
pop esp
aaa
lodsd eax, dword [esi]
aad 0xad
and byte [edx - 0x79], 0x60
ret
bound eax, qword [edi + 0x7741c360]
leave
int3
Function at 0x791188a1
Capabilities:
Encode data using xor

Disassembly:
pushal
pushfd
pop dword [esp + 0x20]
test sp, 0x4122
les esp, [edx]
inc ecx
clc
xor edi, 0x8e99427b
pushal
mov byte [esp + 4], cl
xor edx, 0x9616b7df
mov byte [esp], 0x33
call fcn.79127758
add byte [eax], al
mov eax, 0xc5c1ff3c
dec ebp
fisubr word [ecx]
bswap ebp
arpl bx, ax
lodsb al, byte [esi]
fld st(0)
fnstsw ax
psubw mm4, qword [edx + 0x7e5dd509]
mov dh, 0xfa
rcl al, cl
cmp dword [ebx + eax - 0x24], esp
mov esp, 0x8b30ba96
jnp 0x791188a9
xchg edi, eax
push edi
pop ebp
xor al, 0xab
xchg edx, eax
enter 0xffffffffffff8e21, 0xffffffffffffffe4
mov di, 0xb33
xchg esp, eax
outsd dx, dword [esi]
pop edi
cmp al, 0x26
inc eax
xchg ebp, eax
sub al, 0x88
add ebx, esp
loope 0x791188c5
dec ebx
daa
xchg byte [ebx], bh
sbb byte [ebx - 0x12], dh
salc
in eax, dx
ja 0x79118979
test byte [edx + 0x13244ee6], 0x3e
sub ch, al
invalid
scasd eax, dword es:[edi]
fiadd word [edx + 0x74]
sub al, 0
das
push esi
jae 0x79118973
mov word [ebx - 6], fs
adc al, byte [ebx]
fucompi st(7)
js 0x791189d6
push esp
cmp byte [esi - 0x14], al
mov ah, 0xab
cmp byte [ebx], bh
hlt
retf 0xb6a6

Function at 0x7912a6c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x48]
call fcn.7903aca0
bsr eax, esp
shr eax, 0xf
bt bp, 1
add esp, 0xc
xadd dh, ah
rol ah, 2
btc eax, esi
mov eax, dword [0x79075824]
sbb dx, 0xcac9
cmc
sub eax, dword [ebp - 8]
not dh
xchg cl, dh
mov dword [0x79075824], eax
daa
add dl, 0xa5
mov eax, dword [0x79075828]
movzx dx, bl
xor edx, ebx
mov ecx, dword [eax]
sub dh, ah
sub dx, 0xe2d8
movzx dx, bl
sar dx, cl
sub ecx, dword [ebp - 8]
bswap dx
mov edx, dword [0x79075828]
pushal
lea esp, [esp + 0x20]
jae 0x7912cc13
mov dword [edx], ecx
pushfd
mov word [esp], 0xf35a
pushal
push dword [esp]
lea esp, [esp + 0x28]
jmp 0x79198fcf
jmp 0x790a50bf
call fcn.791c6caf

Function at 0x79158f92
Capabilities:
Encode data using xor

Disassembly:
xor ah, 0x46
shrd ax, cx, 0xd
bsf ax, ax
mov eax, dword ss:[ebp - 4]
btc ecx, 0x12
cmc
bt si, 8
add eax, 1
movzx cx, bl
shld cx, cx, 1
mov dword ss:[ebp - 4], eax
bts ax, 9
push ebp
neg al
aad 0x16
mov ebp, esp
sbb ax, di
bswap ax
setne al
sub esp, 0x58
jmp 0x79158f92
add al, 0x85
sbb ah, ah
mov eax, dword [0x7906d330]
bt ax, sp
xor eax, ebp
pushfd
mov dword [ebp - 4], eax
sar al, cl
lea eax, [ecx - 0x30b631d2]
pushfd
btc ax, 2
mov dword [esp + 4], ebx
cmc
and ah, bh
inc ah
xor ah, dl
mov dword [esp], esi
aam 0x37
sar ax, cl
push edi
and ax, cx
daa
add al, bh
movzx eax, byte [0x7907445a]
bt ebx, eax
test eax, eax
call fcn.790e8a55
add esp, 0x2c
pushfd
mov byte [esp], 0x34
lea esp, [esp + 4]
jmp 0x790a67c2

Function at 0x7916eb2b
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x7909fcbf
lea esp, [esp + 4]
je 0x790b3d40
bt di, 3
clc
push ebx
cmc
cmp dword [0x79074354], 0
mov byte [esp], 0x5e
lea esp, [esp + 4]
jb 0x79020309
push edx
Function at 0x7917619e
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jbe 0x7908a82a
jmp dword [esi - 9]
neg ax
and al, 0xc7
or al, cl
mov byte [ebp - 0x32], 0
sar ah, cl
ror al, 3
movzx eax, byte [ebp - 0x32]
push 0x511bf329
call fcn.7901aab5
out dx, eax
adc edi, esi
sbb eax, 0xa2e2f572
cmp dword [ebx], edx
pop ss
lodsd eax, dword [esi]
xor dl, ah
pop edx
xchg esi, eax
fst qword [ecx + edx - 6]
inc ecx
cmp al, byte [ebx + eax*4]
out dx, eax
dec ebx
xor byte [0x4a5fe650], dl
and esp, edi
cmp dword [ebx], 0x22
loopne 0x791761a7
mov esi, 0x2708c1d8
adc al, byte [eax - 0x3e]
pop ds
inc esi
lds eax, [edx - 0x61404d95]
ja 0x79176221
mov ebx, 0xb1c6a494
cli
in eax, 0x2e
mov dword [ebx + 0x69], esi
inc esi
leave
insd dword es:[edi], dx
inc esi
dec edx
dec eax
imul eax, dword [esi - 0x37], 0x484a466d
popfd
lodsd eax, dword [esi]
inc edi
mov dword [eax - 0x4ab4f4fc], ebx
invalid
xor byte [ecx + 0x42], ch
mov ah, 0x1e
fsub qword [edx + 0xd]
out 0x62, eax
dec edx
test esi, ebx
loop 0x791762a9
push ecx
popal
xlatb
push ds
xchg ebx, eax
rcr ch, 1
in al, dx
xlatb
xchg ebp, eax
outsd dx, dword [esi]
idiv byte [edx]
int1
mov ch, 0x26
or byte [ecx], cl
bound esp, qword [esi - 0x72]
jns 0x7917620a
leave
call [edx - 0x47]
cmp bl, dh
mov bh, 0xc7
push esp
sub eax, 0x40c3dad4
push esi
retf 0xa20d
xor ecx, dword [eax + edx]
lodsd eax, dword [esi]
xchg dword [ebx - 0x7fa12883], ebp
fidivr dword [edx + 0xcd730ca]
aad 0xfe
add dh, byte [ebp - 0x66]
cmp esp, dword [eax]
fidivr word [eax - 0x28bbe924]
mov al, byte [0xf88ae90]
or eax, 0xe96611f2
salc
in al, dx
push edx
invalid

Function at 0x7919a36a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp eax, esi
test ch, 0x2d
cmp dword [ebp - 0x10], 0x7576
pushfd
jmp 0x7916c3ab
mov word [esp], 0xbf10
lea esp, [esp + 4]
je 0x791093ca
not ah
movsx ax, bl
mov al, 0xa4
mov eax, dword [ebp - 0x10]
call fcn.7912770d
movzx edi, al
bt bp, bx
xor eax, eax
not di
not bl
pushfd
mov edi, dword [esp + 4]
jmp 0x791d00ff
push eax
mov dword [ebp - 0x30], eax
bt di, 8
bt esp, esi
bt ebp, 0x17
cmp dword [ebp - 0x10], 0x26c8
jmp 0x791adac7
jmp 0x7912517c
bswap edx
imul ecx, eax, 0x22
mov dword [esp + 0xc], ebx
movzx dx, dl
mov edx, dword [ebp - 4]
cwde
ror ah, cl
mov ah, byte [esp + 0xc]
movzx eax, word [edx + ecx]
movsx dx, al
bt dx, 0xb
clc
not dl
mov dword [ebp - 0x2c], eax
mov byte [esp], 0x4d
rdtsc
pushfd
bts dx, 9
mov eax, 1
rcr ecx, cl
rcl cx, 0xe
mov dx, 0x9c6c
movsx cx, cl
imul ecx, eax, 0x24
pop eax
not dx
cmc
btc dx, bp
mov edx, dword [ebp - 4]
bsr eax, esp
bts ax, ax
or ax, dx
sub ah, 0x2c
movzx eax, byte [edx + ecx]
pushal
sub esp, 0xffffffd0
jne 0x791394f9
push edi
mov dword [ebp - 0x30], eax
cmp ebx, esp
cmp dword [ebp - 0x10], 0x26c8
lea esp, [esp + 4]
lea esp, [esp + 4]
je 0x791093ca
test ch, 6
jp 0x790dd289
cmp dword [ebp - 0x10], 0x7576
jmp 0x7902d4fc
not si
movzx si, dl
mov esi, dword [esp + 8]
pushal
mov ebx, dword [esp + 0x2c]
call fcn.791b42a4
mov esp, ebp
pushfd
mov ebp, dword [esp + 4]
push edx
mov byte [esp], 0x13
pushal
push dword [esp + 0x2c]
ret 0x30
Function at 0x791aa942
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esp, [esp + 0x24]
je 0x79101dbb
mov ax, sp
mov byte [0x790756e9], 1
lea ecx, [edi*2 + 0x1b0b929f]
movsx cx, al
movzx ecx, bl
movzx ax, cl
mov dword [0x790756ec], 0x31000
push 0x1d239e85
cwde
mov dword [0x790756f0], 0x33000
cwde
pop eax
mov byte [ebp - 0x2c], 0x38
bswap ax
seto cl
xchg cx, ax
xchg al, ch
mov byte [ebp - 0x2b], 0x42
push 0xd7f719eb
mov byte [ebp - 0x2a], 0x20
lea eax, [eax - 0x4c54968c]
movsx ax, bl
pushal
movsx cx, al
mov byte [ebp - 0x29], 0x30
pushfd
xchg cx, ax
mov byte [esp + 0x10], 0x56
not ecx
mov byte [ebp - 0x28], 0x34
movsx cx, al
movsx cx, bl
lahf
not cl
mov byte [ebp - 0x27], 0x20
xchg cx, ax
bswap ax
lea ecx, [ebp*4 + 0x5c3748b8]
mov byte [ebp - 0x26], 0x32
push 0xc45f8dcf
pop eax
mov byte [ebp - 0x25], 0x34
cwde
sets al
mov byte [ebp - 0x24], 0x20
lea ecx, [0x8b28fc53]
push dword [esp + 8]
lea ecx, [esp - 0x5082dcbd]
cwde
mov byte [ebp - 0x23], 0x43
lea esp, [esp + 0x2c]
js 0x790911b1
mov byte [ebp - 0x22], 0x33
bswap cx
cwde
xchg cx, ax
mov byte [ebp - 0x21], 0
bswap cx
bswap ax
call fcn.790e0627

Function at 0x791b74f2
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov byte [esp], dh
mov dword [ebp - 0x18], eax
pushal
pushfd
pushfd
pushfd
lea esp, [esp + 0x30]
jmp 0x79190db3
call fcn.7907ed6c
jmp 0x7909fb7e
Function at 0x791ce370
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [ebp - 0x18], 0
jmp 0x7918f233

Function at 0x791d0e41
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [edx], ecx
mov word [esp], 0xab5c
lea esp, [esp + 0x2c]
jmp 0x79198fcf
sub ecx, dword [ebp - 8]
pushfd
pushfd
mov edx, dword [0x79075828]
jmp 0x79090480
lea esp, [esp + 0xc]
call fcn.7903aca0
dec al
add esp, 0xc
pushal
pushfd
rcr cx, cl
mov eax, dword [0x79075824]
movsx dx, al
push dword [esp + 8]
bsr ecx, ecx
shr dl, cl
sub eax, dword [ebp - 8]
mov byte [esp + 4], 0xd8
mov dword [0x79075824], eax
setg ah
shrd eax, edi, 0xf
aas
xadd eax, edx
mov eax, dword [0x79075828]
add edx, ebx
and dh, al
mov ecx, dword [eax]
mov dl, byte [esp + 8]
bts dx, sp
pop edx
jmp 0x79170a55

Function at 0x791db95b
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp]
mov word [esp + 4], 0x43cd
lea esp, [esp + 0x34]
call fcn.791d6159
jmp 0x790f20d0
pushfd
cmp cl, bl
mov dword [ebp - 8], eax
clc
jmp loc.79036965
mov dword [ebp - 4], ecx
movzx cx, al
pop ecx
movzx cx, cl
mov ecx, dword [ebp - 4]
jmp 0x790a2c71

Function at 0x791e091b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
clc
sub ch, ch
mov dword [ebp - 0x30], eax
pop ecx
rol ax, 0xf
pushfd
mov eax, dword [0x79075824]
test esp, 0xdd5b9e7
bswap cx
sub eax, dword [ebp - 0x30]
shl dx, 0xe
sub eax, dword [ebp - 0x10]
btr cx, 9
mov dword [esp + 0x1c], eax
pushfd
sub cl, 0x74
mov byte [esp], ch
mov ecx, dword [ebp - 4]
ror dh, cl
bsr dx, bp
add ecx, dword [ebp - 0x10]
bswap dx
pop edx
pushfd
pushfd
mov dword [esp + 0x20], ecx
push dword [esp]
movzx dx, dl
call fcn.791a2668
call fcn.79129fd2
rdtsc
mov eax, dword [0x79075824]
pushal
mov word [esp], 0xbc2e
sub eax, dword [ebp - 0x30]
bts cx, dx
shrd cx, cx, cl
sbb dh, 0xa2
add dl, 0xa7
sub eax, dword [ebp - 0x10]
xor cx, 0xa5a0
pushal
movzx edx, bl
mov dword [esp + 0x3c], eax
test di, si
mov ecx, dword [ebp - 4]
bsr dx, sp
movzx edx, dl
bts dx, 3
add ecx, dword [ebp - 0x10]
movzx edx, cl
bswap dx
mov dl, bh
sets dh
mov dword [esp + 0x38], ecx
movsx dx, dl
movzx edx, cl
bswap dx
lea edx, [edi - 0x5d77d084]
mov edx, dword [ebp - 4]
pushfd
call fcn.7917b056
jmp 0x79122442
pushfd
lea esp, [esp + 8]
jne 0x790cc0be
rdtsc
sar ax, 0xb
not dh
rcl dh, 3
mov eax, dword [ebp - 4]
mov ch, dh
pushfd
bsr cx, cx
xadd dl, cl
sub eax, dword [0x7907581c]
ror ch, 1
add esp, 4
jle 0x79091a5a
bsr cx, di
mov dword [ebp - 0x30], eax
jno 0x79102964
mov eax, dword [0x79075824]
bsr cx, cx
shrd dx, sp, 6
sub eax, dword [ebp - 0x30]
movsx cx, dl
sub eax, dword [ebp - 0x10]
sal dh, 2
or ecx, 0x5f798534
push eax
ror dh, 4
mov cl, cl
mov ecx, dword [ebp - 4]
shrd dx, di, cl
add ecx, dword [ebp - 0x10]
jmp 0x7913022d
call fcn.790aa388
jmp 0x79172e99
push esp
pushal
pushfd
mov dword [esp + 0x24], 0x18bc0262
push edx
mov byte [esp], 0xb2
mov byte [esp + 4], dl
pushfd
lea esp, [esp + 0x2c]
jmp loc.79010376
cmc
cmp dword [ebp - 0x1c], 0x7576
jmp 0x7911a641
Function at 0x4105dc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4106bf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41067b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x410658
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x410656
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x410679
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x410679
push 0
push 0
call fcn.00423217
pop ecx
pop ecx
jmp 0x4106bd
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.0040e49b
add esp, 0x20
jmp 0x410716
lea eax, [ebp + 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x4106d9
push 0
call fcn.00410b07
pop ecx
jmp 0x410716
push 0x6cf5
push 0x7fd
push 1
push 0x558
push 0x19fa
push 0x7f54
push 0
push 1
push 0x35a4
push 0x5089
push 0
push 0x7335
push 0x1ab0
call fcn.00421623
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x41b039
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x41b0d9
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41b0a6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41b099
mov byte [ebp - 1], 0
push 0x4a3d
push 1
push 0x511
push 0x1ebb
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.00416ef2
add esp, 0x1c
jmp 0x41b0a4
push 0x140d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x41b0d4
push 0x273e
push 0x5a01
push 0
push 1
push 0x47ea
push 1
push 0x20c3
push 0x5fc
push 1
push 0x68be
call fcn.00417ac0
add esp, 0x28
jmp 0x41b198
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41b167
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41b12d
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x41b165
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.0042f1b3
mov esi, eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.0042f1b3
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x41b198
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
push 0x3afa
push 0x41ff
push 0x3ce6
push 1
push dword [ebp - 0x48]
push 1
push 1
mov eax, dword [ebp - 0x4c]
push dword [eax]
call fcn.0040b2f2
add esp, 0x20
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422316
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4223bf
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42239b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x422377
push 0x6f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x422399
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x4223bd
push 0x9a1
push 1
push 0x17ab
push 1
push 1
push 0xe3a
push 0x2e04
call fcn.004159ff
add esp, 0x1c
jmp 0x4223e7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
push 0
push dword [ebp - 0x30]
push 0x48be
push dword [ebp - 0x34]
push 1
push 0x5d9
call fcn.0042a041
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x42249a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x42254b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x422523
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x422506
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x422504
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x422521
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0x5851
push 0
push 0
call fcn.0042190b
add esp, 0x14
jmp 0x422549
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x533a
push 1
push dword [ebp - 0x28]
push 0
push 0
push 0x23e
push 0x32ba
call fcn.004159ff
add esp, 0x1c
jmp 0x422575
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
push 0x720a
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
push eax
push 0x2ede
push dword [ebp - 0x30]
push 1
call fcn.0040c1f2
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x426de8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x426f50
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x426eb8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x426ea8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xfffffff7
jmp 0x426e64
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x16
je 0x426ea6
mov dword [ebp - 8], 0
jmp 0x426e7c
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x426e8f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], 0x5725
jmp 0x426e75
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x54], eax
jmp 0x426e59
jmp 0x426eb3
push 0x140d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x426f4e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x426ee8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
and dword [eax], 0
jmp 0x426f4e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x426f4e
push 1
push 0x3187
push 0xbd0
push 0x2d51
push 0
push 0x70f8
push 1
push 0x2f6e
push 1
push 0x1d34
push 0x6e8b
push 0x7607
push 0x3f93
push 0x4a0e
push 0x7fa0
push 0
push 0x4858
push 1
call fcn.0041a549
add esp, 0x48
jmp 0x426f5e
push 1
push 0x7b08
call fcn.0041491c
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x429646
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4296ab
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
push 0x3978
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x18]
push 0x660a
push dword [ebp - 0x1c]
push 0xfdc
call fcn.00429724
add esp, 0x2c
jmp 0x429720
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4296d1
push 1
call fcn.0042690c
pop ecx
jmp 0x429720
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x429700
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4296fe
push 0x20e6
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x429720
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x429720
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret