joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x4023c2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x4023eb
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x24
idiv ecx
add edx, 0x26
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x4023b3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x40241c
jmp 0x40248d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x402441
jmp 0x40248d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x40247c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x402d10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xe1
mov dword [ebp - 8], 0x19
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x402d80
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x402d82
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402ef0
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x8d
mov dword [ebp - 8], 0xe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x402f4b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x402f4d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402f60
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x87
mov dword [ebp - 8], 0xc7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x402fd6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x402fd8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402fe0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x92
mov dword [ebp - 8], 0xa8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x403050
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x403052
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403340
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x78
mov dword [ebp - 8], 0xbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x403395
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x403397
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403480
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x6e
mov dword [ebp - 8], 0xc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x4034d5
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x4034d7
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403630
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0xb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x403685
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x403687
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403690
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x96
mov dword [ebp - 8], 0x87
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x4036eb
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x4036ed
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4039f0
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0xe9
mov dword [ebp - 8], 0x8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x403a4b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x403a4d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403cd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0xdb
mov dword [ebp - 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x403d25
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x403d27
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403f10
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x403f31
cmp dword [ebp - 4], 4
je 0x403f31
cmp dword [ebp - 4], 8
je 0x403f31
jmp 0x403f48
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x403f4e
xor eax, eax
jmp 0x403f4e
mov esp, ebp
pop ebp
ret

Function at 0x403fe0
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x31
mov dword [ebp - 8], 0xdc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x404056
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x404058
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4044a0
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x42
mov dword [ebp - 8], 0x9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x4044fb
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x4044fd
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x404510
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0xc
mov dword [ebp - 8], 0x12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x40456b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x40456d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x404980
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x95
mov dword [ebp - 8], 0xfb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x4049f6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x4049f8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x404a90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x404ab1
cmp dword [ebp - 4], 4
je 0x404ab1
cmp dword [ebp - 4], 8
je 0x404ab1
jmp 0x404ac2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x404ac8
xor eax, eax
jmp 0x404ac8
mov esp, ebp
pop ebp
ret

Function at 0x404c20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xe1
mov dword [ebp - 8], 0xdb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x404c90
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x404c92
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x404d70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xc2
mov dword [ebp - 8], 0xf1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x404de0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x404de2
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x404df0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xb4
mov dword [ebp - 8], 0x5e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x404e60
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x404e62
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x405020
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x66
mov dword [ebp - 8], 0xc6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x405090
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x405092
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x405310
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x8a
mov dword [ebp - 8], 0xfc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x405386
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x405388
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x405390
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x93
mov dword [ebp - 8], 0xfd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x405406
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x405408
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x405470
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xf8
mov dword [ebp - 8], 0x16
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x4054e0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x4054e2
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x405550
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xf4
mov dword [ebp - 8], 0xb1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x4055c6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x4055c8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x405800
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x4a
mov dword [ebp - 8], 0xa5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x405876
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x405878
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x405bf0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xcf
mov dword [ebp - 8], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x405c60
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x405c62
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4061f0
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xaa
mov dword [ebp - 8], 0xd0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x406266
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x406268
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406390
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 3
idiv ecx
add edx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
jmp 0x4063c3
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x4063e1
call dword [sym.imp.MSVCR90.dll_rand]
cdq
idiv dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edx, [ecx + edx + 1]
mov dword [ebp - 4], edx
jmp 0x4063ba
cmp dword [ebp - 4], 0
jge 0x4063fc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x4063fe
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406690
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x6b
mov dword [ebp - 8], 0xe9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x406700
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x406702
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x406930
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x14
mov dword [ebp - 8], 0xfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
push 0
push 0x63
push edx
push eax
call fcn.00461ff0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jbe 0x40698b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x40698d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406a70
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xe8
mov dword [ebp - 8], 0x68
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x406ae6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x406ae8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406be0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 3
idiv ecx
add edx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
jmp 0x406c13
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x406c31
call dword [sym.imp.MSVCR90.dll_rand]
cdq
idiv dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edx, [ecx + edx + 1]
mov dword [ebp - 4], edx
jmp 0x406c0a
cmp dword [ebp - 4], 0
jge 0x406c46
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x406c48
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406c50
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xbd
mov dword [ebp - 8], 0xd9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
call fcn.00401070
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call sub.MSVCR90.dll_sin
add esp, 8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
fild qword [ebp - 0x18]
fcompp
fnstsw ax
test ah, 5
jp 0x406cc6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
jmp 0x406cc8
xor eax, eax
mov esp, ebp
pop ebp
ret