joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5268c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x290
mov eax, dword [0x552a7c]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004f7580
push 0x80
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.005257b0
lea eax, [esp + 0x1a0]
mov edx, edi
mov ecx, eax
add esp, 0x10
mov esi, 0x104
sub edx, ecx
lea esp, [esp]
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x52692b
mov cl, byte [edx + eax]
test cl, cl
je 0x52692b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x526910
jmp 0x52692f
test esi, esi
jne 0x526930
dec eax
lea edx, [esp + 0x10]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x198]
push eax
call fcn.0040a5b0
push 0xff
lea ecx, [esp + 0x95]
push 0
push ecx
mov dword [esp + 0x18], 1
mov byte [esp + 0x9c], 0
call fcn.004f7580
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x540d6c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], pe_nt_image_headers32
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x526a0b
mov ecx, edi
lea eax, [esp + 0x90]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5269d3
test dl, dl
je 0x5269cf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5269d3
add eax, 2
add ecx, 2
test dl, dl
jne 0x5269b3
xor eax, eax
jmp 0x5269d8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x526a0b
lea eax, [esp + 0x90]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5269e6
sub eax, edx
push eax
lea edx, [esp + 0x94]
push edx
push 1
push str.mid_old
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x526a15
sub eax, edx
push eax
lea eax, [esp + 0x194]
push eax
push 1
push 0x540d6c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x294]
pop esi
pop ebx
xor ecx, esp
call fcn.004f7567
add esp, 0x290
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x437d13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x437d22
pop dword [ebp - 0x30]
mov eax, 0xba7a3901
add eax, 0x45c94421
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x4f9c2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x6e47f84a
add ecx, 0x91b84dcb
mov edx, eax
mov esi, 0x475e00
add esi, dword [ebp - 0x30]
mov ebx, 0x9d6e66b6
sub ebx, 0xfac87117
xor dword [ebp - 0x2c], edx
mov edi, dword [esi]
add dword [ebp - 0x14], edi
xor edi, ebx
mov dword [ebp - 4], 0xd15a38fb
mov dword [edx], edi
sub dword [ebp - 0x1c], 0x850970df
add edx, 0xb46d023d
sub edx, 0xb46d0239
add esi, 0x52fd448b
sub esi, 0x52fd4487
loop 0x437d76
add eax, 0x650c5206
sub eax, 0x650b46df
mov ebx, eax
add eax, 5
mov ecx, 0xffe3fc4e
sub ecx, 0xffa3fc4e
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001715e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10028108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10017184
xor eax, eax
jmp 0x10017243
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x100171a6
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x100171a6
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x10017243
cmp dword [esi + 0x4c], 0
je 0x10017241
call fcn.100173d8
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100171d2
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10017241
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10017241
cmp eax, 1
jle 0x1001720f
cmp eax, 3
jne 0x10017241
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 0x25]
push ecx
jmp 0x100171c3
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x10017233
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x10017241
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x10017243
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018d7d
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401120
Capabilities:
Create directory
Create shortcut via ishelllink

Disassembly:
sub esp, 0x82c
mov eax, dword [0x433480]
xor eax, esp
mov dword [esp + 0x828], eax
mov eax, dword [esp + 0x834]
push ebx
mov ebx, dword [esp + 0x83c]
push ebp
mov ebp, dword [esp + 0x848]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x840]
push eax
push 0x435980
lea eax, [esp + 0x20]
push 0x4292ec
push eax
call fcn.004054e0
lea eax, [esp + 0x230]
push esi
push eax
call fcn.00402470
add esp, 0x18
test eax, eax
jne 0x4011b4
push esi
push str.An_error_occurred_while_attempting_to_find_the_path_to__s._n
call fcn.00404f30
cmp byte [esi], 0x64
mov ecx, str.in_the_Start_menu
mov eax, str.on_the_desktop
cmovne eax, ecx
push eax
push edi
push str.An_error_has_occurred.__A_shortcut_to__s_will_not_be_created__s._n
call fcn.00404f30
add esp, 0x14
jmp 0x4012ec
lea eax, [esp + 0x220]
push eax
call fcn.004132a4
push edi
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x63c]
push str._s_s.lnk
push eax
call fcn.004054e0
add esp, 0x14
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x4011fd
push str.Error:__Could_not_open_the_COM_library.__Not_creating_shortcut._n
call fcn.00404f30
add esp, 4
jmp 0x4012ec
lea eax, [esp + 0x10]
push eax
push 0x429d68
push 1
push 0
push 0x429d88
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4012de
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x429d78
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
test eax, eax
js 0x4012cf
push 0x208
lea eax, [esp + 0x224]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x63c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 0x10]
push ebp
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x24]
call eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 0
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0x10]
push ebx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2c]
call eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x220]
push 1
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, 1
jmp 0x4012ee
push str.QueryInterface_Error_n
call fcn.00404f30
add esp, 4
jmp 0x4012ec
push eax
push str.CoCreateInstance_Error___hres___08x_n
call fcn.00404f30
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x838]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040609c
add esp, 0x82c
ret
Function at 0x4020d0
Capabilities:
Set current directory

Disassembly:
push ecx
push esi
push edi
push dword [0x435968]
call fcn.00404d70
push 0x4279f0
call fcn.00414b97
mov edi, dword [esp + 0x18]
add esp, 8
mov esi, 0x432248
push dword [esi - 0x14]
call fcn.004050e0
add esp, 4
mov dword [esi], eax
test edi, edi
jne 0x402113
push dword [esi - 0xc]
call fcn.004050e0
add esp, 4
mov dword [esi + 4], eax
cmp dword [0x433f88], 0
jne 0x40216c
mov eax, dword [esi]
test eax, eax
je 0x40216c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402125
sub eax, edx
inc eax
push eax
call fcn.0041130b
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x40220d
mov edx, dword [esi]
mov dword [0x433f88], ecx
nop word [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x402150
push dword [0x433f88]
call fcn.00404f60
add esp, 4
test edi, edi
je 0x402185
mov eax, dword [esi]
test eax, eax
je 0x402185
push eax
call fcn.004112f0
add esp, 4
mov dword [esi], 0
add esi, 0x228
cmp esi, 0x433388
jl 0x4020f4
mov cl, byte [0x435980]
mov eax, 0x435980
test cl, cl
je 0x402209
cmp byte [0x435981], 0x3a
jne 0x4021fb
mov ax, word [0x4279f4]
mov word [esp + 8], ax
mov al, byte [0x4279f6]
push ebx
movsx ebx, cl
mov byte [esp + 0xe], al
lea edx, [ebx - 0x61]
lea eax, [ebx - 0x20]
cmp edx, 0x19
movzx ecx, al
movzx eax, bl
cmova ecx, eax
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x10], cl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop ebx
test eax, eax
je 0x402209
cmp byte [0x435982], 0
mov eax, 0x435982
je 0x402209
pop edi
pop esi
add esp, 4
mov dword [esp + 4], eax
jmp fcn.00414b97
pop edi
pop esi
pop ecx
ret
push str.ERROR:_out_of_memory_n
call fcn.00404f30
add esp, 4
push 1
call fcn.00411651
int3
Function at 0x402230
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, 0x435980
push edi
mov edi, dword [ebp]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x402242
sub esi, ecx
test edi, edi
je 0x402339
push esi
push 0x435980
push edi
call fcn.00414665
add esp, 0xc
test eax, eax
jne 0x402339
movsx eax, byte [esi + edi]
add esi, edi
push eax
push 0x427bc4
call fcn.00406ab0
add esp, 8
inc esi
test eax, eax
je 0x402339
push 0x5c
push esi
call fcn.00406ab0
add esp, 8
test eax, eax
jne 0x402339
push 0x2f
push esi
call fcn.00406ab0
add esp, 8
test eax, eax
jne 0x402339
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4022b2
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.00401070
add esp, 4
mov edi, eax
mov edx, esi
sub eax, esi
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax + edx - 1], cl
test cl, cl
jne 0x4022d0
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4022e2
sub ecx, edx
push 0
push edi
mov byte [ecx + edi - 1], 0x78
call fcn.0041479d
add esp, 8
push edi
push esi
test eax, eax
je 0x40233d
call fcn.00409ea2
add esp, 8
test eax, eax
jne 0x402352
push ebx
push esi
call fcn.004050e0
push esi
push edi
mov ebx, eax
call fcn.00409ea2
add esp, 0xc
test eax, eax
jne 0x402370
push dword [ebp]
call fcn.004112f0
push edi
call fcn.004112f0
add esp, 8
mov dword [ebp], ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push edi
push str._nERROR:__s_and__s_clash.__Remove_or_rename__s._n
call fcn.00404f30
add esp, 0x10
push 1
call fcn.00404de0
push 0
call fcn.004127c1
push eax
push edi
push esi
push str._nERROR:_failed_to_rename__s_to__s:__s_n
call fcn.00404f30
add esp, 0x14
push 1
call fcn.00404de0
push 0
call fcn.004127c1
push eax
push esi
push edi
push str._nERROR:_failed_to_rename__s_back_to__s:__s_n
call fcn.00404f30
add esp, 0x14
push 1
call fcn.00404de0
int3
Function at 0x4026f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x433480]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push edi
push str.VIMRUNTIME
call fcn.00412571
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x40279a
cmp byte [ecx], 0
je 0x40279a
mov edx, ecx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x402727
sub edx, esi
cmp edx, 0x208
jae 0x40279a
lea edx, [esp + 0x210]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402741
lea ecx, [esp + 0x210]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402758
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
jle 0x402791
nop dword [eax + eax]
lea edx, [esp + 0x210]
mov cl, byte [edx + eax]
cmp cl, 0x2f
je 0x40278d
cmp cl, 0x5c
je 0x40278d
dec eax
test eax, eax
jg 0x402770
mov esi, edx
jmp 0x4027c1
mov byte [edx + eax], 0
lea esi, [esp + 0x210]
jmp 0x4027c1
push 0x427c58
call fcn.00412571
mov esi, eax
add esp, 4
test esi, esi
je 0x4027b2
cmp byte [esi], 0
jne 0x4027c1
mov eax, dword [0x433f8c]
mov esi, 0x42738e
test eax, eax
cmovne esi, eax
lea eax, [esp + 8]
push eax
push 0x1fc
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4027d8
sub ecx, edx
test ecx, ecx
jle 0x402809
mov al, byte [esp + ecx + 7]
cmp al, 0x5c
je 0x402809
cmp al, 0x2f
je 0x402809
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4027f6
mov ax, word [0x4279f0]
mov word [edi], ax
lea ecx, [esp + 8]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402810
mov eax, dword [str.vimini.ini]
mov dword [ecx], eax
mov eax, dword [0x427c60]
mov dword [ecx + 4], eax
mov ax, word [0x427c64]
mov word [ecx + 8], ax
mov al, byte [0x427c66]
mov byte [ecx + 0xa], al
lea eax, [esp + 8]
push 0x4279ac
push eax
call fcn.00409902
mov edi, eax
add esp, 8
test edi, edi
je 0x40288a
push str._vimini__n
push edi
call fcn.00402390
push esi
push str.dir__s__n
push edi
call fcn.00402390
push edi
call fcn.004094b8
add esp, 0x18
pop edi
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0040609c
add esp, 0x414
ret
lea eax, [esp + 8]
push eax
push str.Failed_to_open__s_n
call fcn.00404f30
add esp, 8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.0040609c
add esp, 0x414
ret
Function at 0x404d70
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
test al, al
je 0x404dd7
cmp byte [esi + 1], 0x3a
jne 0x404dcc
push ebx
movsx ebx, al
mov ax, word [0x4279f4]
mov word [esp + 0xc], ax
mov al, byte [0x4279f6]
mov byte [esp + 0xe], al
lea edx, [ebx - 0x61]
lea eax, [ebx - 0x20]
cmp edx, 0x19
movzx ecx, al
movzx eax, bl
cmova ecx, eax
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x10], cl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop ebx
test eax, eax
jne 0x404dc4
or eax, 0xffffffff
pop esi
ret
add esi, 2
cmp byte [esi], 0
je 0x404dd7
push esi
call fcn.00414b97
add esp, 4
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x406773
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4067b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4067b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4067b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4067b2
cmp dword [ecx + 0x74], 0xe
jbe 0x4067b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x413073
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x433480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x42b648
push esi
call fcn.0041a240
pop ecx
pop ecx
test eax, eax
jne 0x4130a1
xor al, al
jmp 0x41311e
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.00412db4
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x4130db
push dword [ebp - 0x210]
call fcn.004112f0
xor al, al
jmp 0x41311c
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4130e1
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x413101
push edx
call fcn.00412faa
pop ecx
test al, al
je 0x4130cc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41310f
mov bl, 1
push dword [ebp - 0x210]
call fcn.004112f0
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040609c
leave
ret

Function at 0x4152a9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42be80
push 0x42be78
push str.FlsAlloc
push 0x1f
call fcn.00415168
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4152dd
push dword [ebp + 8]
mov ecx, esi
call dword [0x4261cc]
call esi
jmp 0x4152e3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x415327
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42be90
push 0x42be88
push str.FlsGetValue
push 0x21
call fcn.00415168
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41535e
push dword [ebp + 8]
mov ecx, esi
call dword [0x4261cc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x415366
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42be98
push 0x42be90
push str.FlsSetValue
push 0x22
call fcn.00415168
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4153a0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4261cc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41bb79
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41bc16
push ebx
push esi
call fcn.0041bb42
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041bad6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41bbc3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41bc15
push edi
push eax
call fcn.00417688
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41bbe3
call fcn.00414ffb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41bc14
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041bad6
add esp, 0x20
test eax, eax
jne 0x41bc02
push edi
call fcn.00414ffb
jmp 0x41bc0a
push ebx
call fcn.00414ffb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41bc19
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x41bc2a
pop esi
ret
push ebx
push edi
push esi
call fcn.0041bb42
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00417688
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41bc52
push ebx
push esi
push edi
call fcn.00407ca0
add esp, 0xc
push 0
call fcn.00414ffb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x41c3ac
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041bec7