joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009842a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1008929d
and dword [ebp - 4], 0
cmp dword [0x100d3140], 0
mov ebx, eax
jne 0x100984db
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1009858c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100bbac8
push edi
call esi
test eax, eax
je 0x1009858c
push eax
call fcn.1008922b
mov dword [esp], 0x100bbab8
push edi
mov dword [0x100d3140], eax
call esi
push eax
call fcn.1008922b
mov dword [esp], 0x100bbaa4
push edi
mov dword [0x100d3144], eax
call esi
push eax
call fcn.1008922b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100d3148], eax
call esi
push eax
call fcn.1008922b
pop ecx
mov dword [0x100d3150], eax
test eax, eax
je 0x100984db
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1008922b
pop ecx
mov dword [0x100d314c], eax
mov eax, dword [0x100d314c]
cmp eax, ebx
je 0x10098533
cmp dword [0x100d3150], ebx
je 0x10098533
push eax
call fcn.100892a6
push dword [0x100d3150]
mov esi, eax
call fcn.100892a6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10098533
test edi, edi
je 0x10098533
call esi
test eax, eax
je 0x1009852a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1009852a
test byte [ebp - 0xc], 1
jne 0x10098533
or dword [ebp + 0x10], 0x200000
jmp 0x1009856c
mov eax, dword [0x100d3144]
cmp eax, ebx
je 0x1009856c
push eax
call fcn.100892a6
pop ecx
test eax, eax
je 0x1009856c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1009856c
mov eax, dword [0x100d3148]
cmp eax, ebx
je 0x1009856c
push eax
call fcn.100892a6
pop ecx
test eax, eax
je 0x1009856c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100d3140]
call fcn.100892a6
pop ecx
test eax, eax
je 0x1009858c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1009858e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487747
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
mov eax, dword [0x4ef044]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x4892dc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4c], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov byte [ebp - 0x30], 0x4b
mov byte [ebp - 0x2f], 0x45
mov byte [ebp - 0x2e], 0x52
mov byte [ebp - 0x2d], 0x4e
mov byte [ebp - 0x2c], 0x45
mov byte [ebp - 0x2b], 0x4c
mov byte [ebp - 0x2a], 0x33
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x28], 0x2e
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x20], 0x56
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x46
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x44], eax
push 0x4892f8
push 0x489308
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x48], eax
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp + 8]
mov dword [ebp - 0x34], edx
nop
nop
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x401789
mov dword [ebp - 0x3c], 0x44
push 0x4a6534
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00404a00
jmp 0x401865
mov dword [ebp - 4], 0xffffffff
jmp 0x401875
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402950
mov esp, ebp
pop ebp
ret
Function at 0x401a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48778b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
mov eax, dword [0x4ef044]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x40], 0x48
mov byte [ebp - 0x3f], 0x65
mov byte [ebp - 0x3e], 0x61
mov byte [ebp - 0x3d], 0x70
mov byte [ebp - 0x3c], 0x46
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x65
mov byte [ebp - 0x39], 0x65
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x24], 0x4b
mov byte [ebp - 0x23], 0x45
mov byte [ebp - 0x22], 0x52
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4c
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0
push 0x4891c0
push 0x4891cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x50
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x6f
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x73
mov byte [ebp - 0x2a], 0x48
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], 0x70
mov byte [ebp - 0x26], 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x48], eax
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x401b1f
mov dword [ebp - 0x44], 0x63
push 0x4a6534
lea eax, [ebp - 0x44]
push eax
call fcn.00404a00
jmp 0x401b38
mov dword [ebp - 4], 0xffffffff
jmp 0x401b48
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402950
mov esp, ebp
pop ebp
ret
Function at 0x401b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4877b2
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x44
mov eax, dword [0x4ef044]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x24], 0x4b
mov byte [ebp - 0x23], 0x45
mov byte [ebp - 0x22], 0x52
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4c
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x34], 0x56
mov byte [ebp - 0x33], 0x69
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x41
mov byte [ebp - 0x2c], 0x6c
mov byte [ebp - 0x2b], 0x6c
mov byte [ebp - 0x2a], 0x6f
mov byte [ebp - 0x29], 0x63
mov byte [ebp - 0x28], 0
push 0x4891dc
push 0x4891ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x54], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
lea ecx, [eax + ecx + 0x18]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x401c6b
mov dword [ebp - 0x4c], 0x50
push 0x4a6534
lea eax, [ebp - 0x4c]
push eax
call fcn.00404a00
jmp 0x401d8b
mov dword [ebp - 4], 0xffffffff
jmp 0x401d9b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402950
mov esp, ebp
pop ebp
ret
Function at 0x401fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487800
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x4c
mov eax, dword [0x4ef044]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x489254
push 0x489260
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x58], eax
nop
nop
nop
nop
nop
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0
push str.VirtualProtect
push 0x489280
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ecx + edx + 0x18]
mov dword [ebp - 0x28], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x4020b7
mov dword [ebp - 0x44], 0x40
push 0x4a6534
lea ecx, [ebp - 0x44]
push ecx
call fcn.00404a00
jmp 0x402240
mov dword [ebp - 4], 0xffffffff
jmp 0x402250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402950
mov esp, ebp
pop ebp
ret

Function at 0x414f40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00414b60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414f72
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x489164]
call dword [ebp - 8]
jmp 0x414f7c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x45eab0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.0045e950
lea ecx, [ebp - 4]
call fcn.0045ea80
movzx eax, al
test eax, eax
jne 0x45eaed
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.0045e970
mov eax, dword [ebp - 0x18]
jmp 0x45ec15
lea ecx, [ebp - 4]
call fcn.0045ea50
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0045ea10
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.0045ea50
push eax
push 0
push 0
call fcn.0045e890
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45eb53
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.0045e970
mov eax, dword [ebp - 0x20]
jmp 0x45ec15
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00421a40
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.004054b0
lea ecx, [ebp - 8]
call fcn.00405530
movzx edx, al
test edx, edx
jne 0x45eb9c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.004054f0
lea ecx, [ebp - 4]
call fcn.0045e970
mov eax, dword [ebp - 0x24]
jmp 0x45ec15
lea ecx, [ebp - 8]
call fcn.00405610
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.0045ea50
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.0045e890
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x45ebf7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.004054f0
lea ecx, [ebp - 4]
call fcn.0045e970
mov eax, dword [ebp - 0x34]
jmp 0x45ec15
lea ecx, [ebp - 8]
call fcn.004184e0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.004054f0
lea ecx, [ebp - 4]
call fcn.0045e970
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x45ec20
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.0045e950
lea ecx, [ebp - 4]
call fcn.0045e990
movzx eax, al
test eax, eax
jne 0x45ec5d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.0045e970
mov eax, dword [ebp - 0x14]
jmp 0x45ed17
lea ecx, [ebp - 4]
call fcn.0045ea50
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0045ea10
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.00421a40
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00418390
lea ecx, [ebp - 8]
call fcn.00418410
movzx ecx, al
test ecx, ecx
jne 0x45eccd
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.004183b0
lea ecx, [ebp - 4]
call fcn.0045e970
mov eax, dword [ebp - 0x1c]
jmp 0x45ed17
lea ecx, [ebp - 4]
call fcn.0045ea50
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.00418540
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00404320
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00418510
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.004183b0
lea ecx, [ebp - 4]
call fcn.0045e970
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x467780
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00466e20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4677b4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x489164]
call dword [ebp - 8]
jmp 0x4677ba
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x467810
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00466e60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x467844
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x489164]
call dword [ebp - 8]
jmp 0x46784e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x467860
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00466e80
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x467898
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x489164]
call dword [ebp - 8]
jmp 0x4678a6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x467970
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00466f20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4679b0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x489164]
call dword [ebp - 8]
jmp 0x4679ce
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00467d30
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4705e0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.0045bc10
lea ecx, [ebp - 0x34]
call fcn.0045bc10
call fcn.0045bfa0
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045a9e0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x470633
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.0045bd30
lea ecx, [ebp - 0x4c]
call fcn.0045bd30
mov eax, dword [ebp - 8]
jmp 0x4706a8
call fcn.0045bfa0
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0045a9e0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47066e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.0045bd30
lea ecx, [ebp - 0x4c]
call fcn.0045bd30
mov eax, dword [ebp - 0x10]
jmp 0x4706a8
lea ecx, [ebp - 0x34]
call fcn.0045c3c0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.0045c3c0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.0045bd30
lea ecx, [ebp - 0x4c]
call fcn.0045bd30
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x47b130
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00486240
mov eax, dword [0x4ef044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4f0a18]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x47b308
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x47b257
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x47b257
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x47b235
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x47b1b9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x47b2c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x47b328
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x47b303
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x47b328
jmp 0x47b192
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402950
mov esp, ebp
pop ebp
ret
Function at 0x47b340
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00486240
mov eax, dword [0x4ef044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4f0a18]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x47b52b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x47b476
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x47b476
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x47b452
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x47b3c9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x47b4e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x47b54b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x47b526
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x47b54b
jmp 0x47b3a2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402950
mov esp, ebp
pop ebp
ret