joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba8c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd0
mov ebx, eax
xor esi, esi
test byte [ebx + 0x4ec], 8
je 0x4ba9a1
mov eax, dword [ebx + 0x280]
test eax, eax
jl 0x4ba9d0
cmp dword [ebx + 0x284], 0
jl 0x4ba9d0
mov edx, eax
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov esi, eax
push esp
mov ecx, dword [ebx + 0x284]
mov edx, dword [ebx + 0x280]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x1cc]
mov edx, dword [ebx + 0x284]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x128]
mov edx, eax
mov ecx, esp
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x64]
mov edx, esp
mov eax, ebx
call fcn.004baf2c
test byte [ebx + 0x490], 0x40
jne 0x4ba952
dec dword [esp + 8]
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.004b8438
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 4]
jle 0x4ba979
xor edx, edx
mov eax, dword [ebx + 0x2d4]
call fcn.00445d0c
jmp 0x4baa92
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.004b8438
mov eax, dword [esp + 0x20]
cmp eax, dword [esp]
jle 0x4ba9d0
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.004b8438
mov eax, dword [esp + 0x20]
mov dword [esp], eax
jmp 0x4ba9d0
test byte [ebx + 0x4ec], 0x40
je 0x4baa92
mov edx, dword [ebx + 0x2dc]
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov esi, eax
mov ecx, esp
mov edx, dword [ebx + 0x2dc]
mov eax, ebx
call fcn.004b897c
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [esp + 8]
push eax
call sub.user32.dll_InflateRect
cmp dword [esp], 0
jge 0x4ba9e9
xor eax, eax
mov dword [esp], eax
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.004b8438
mov eax, dword [esp + 0x20]
cmp eax, dword [esp]
jle 0x4baa10
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.004b8438
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov ebx, dword [ebx + 0x2d4]
push 0
mov eax, ebx
call fcn.0044c60c
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
test al, 0x10
setne al
and eax, 0x7f
mov eax, dword [eax*4 + 0x4e8648]
or eax, 0x40
push eax
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 8]
sub eax, ebp
push eax
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 8]
sub eax, edi
push eax
push ebp
push edi
push 0
mov eax, ebx
call fcn.0044c60c
push eax
call sub.user32.dll_SetWindowPos
mov eax, ebx
call fcn.0044c60c
push eax
call sub.user32.dll_SetFocus
lea edx, [esp + 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, ebx
call fcn.0044c60c
push eax
call sub.user32.dll_InvalidateRect
add esp, 0x30
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bd68c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bd808
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x94]
mov eax, dword [ebx + 0x208]
call fcn.004251f8
mov dword [ebp - 8], eax
mov edx, esi
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x94]
mov eax, dword [ebx + 0x208]
call fcn.004251dc
mov edi, eax
mov edx, esi
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov al, byte [eax + 0x98]
sub al, 1
jb 0x4bd750
jne 0x4bd79f
mov edx, esi
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
add eax, 2
mov dword [ebp - 0x18], eax
add edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, ebx
call fcn.004b8720
mov edi, eax
mov eax, dword [ebp - 8]
add eax, 2
sub edi, eax
mov dword [ebp - 0x14], edi
add edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
jmp 0x4bd79f
mov edx, esi
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
lea edx, [edi + 2]
sub eax, edx
mov dword [ebp - 0x18], eax
add edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, ebx
call fcn.004b8720
mov dword [ebp - 0x14], eax
mov edx, esi
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 0x10]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov edi, dword [ebx + 0x208]
mov eax, dword [edi + 0xc]
mov dl, byte [0x4bd818]
call fcn.004246fc
mov eax, dword [edi + 0xc]
mov edx, dword [ebx + 0x4d4]
call fcn.00424430
mov edx, esi
mov eax, dword [ebx + 0x4dc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x94]
lea eax, [ebp - 0x1c]
call fcn.00404f8c
mov eax, dword [ebp - 0x1c]
push eax
push 0
xor ecx, ecx
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x208]
call fcn.0049c440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd80f
lea eax, [ebp - 0x1c]
call fcn.00404e28
ret
Function at 0x4e06b0
Capabilities:
Encode data using xor

Disassembly:
and al, 0xb2
mov dword [edx + 0x559c0df1], edx
pushfd
push ebp
inc ecx
push 2
xchg ebp, eax
fadd qword [ecx + 0x46]
movsb byte es:[edi], byte [esi]
out 0xf5, eax
inc eax
xor eax, 0xdaeccee2
out dx, eax
push 0xe6fadfc4
test al, 0xe6
xchg byte [edx + 0x24], ah
aas
jns 0x4e06b6
xor dword [eax + 0x1c], esp
fadd dword [0x96004ab0]
pop ebp
or ebp, dword [ebp + 0x47]
invalid

Function at 0x561e50
Capabilities:
Encode data using xor

Disassembly:
fldenv [edx + 0x2c7689b8]
cld
out 0xa9, al
sub dh, bh
pop ecx
iretd
loope 0x561d43
insb byte es:[edi], dx
jle 0x561d59
popfd
or dh, byte [ebp + 0x6d]
mov byte [0x12c69ce0], al
mov al, byte [0x42cc5d6d]
scasd eax, dword es:[edi]
push ds
iretd
loopne 0x561ce1
invalid
dec ebp
sti
xlatb
or ebx, dword [eax - 0x75]
sbb eax, 0x4c660876
dec sp
mov ecx, 0xee4348d2
mov ah, 0xa0
std
fcom qword [edx]
sub ebx, ebp
sbb eax, 0x9f97f7eb
movsd dword es:[edi], dword [esi]
jno 0x561d39
int 0xdf
and byte [esi - 0x2c8004c8], ah
clc
ret
xor byte [ebx + 0x1db553c1], ah
ja 0x561d50
stc
das
dec edi
cmpsd dword [esi], dword es:[edi]
lahf
jp 0x561d78
jle 0x561db8
adc eax, 0xadb36543
fst dword [edi + edi*8 - 0x38dd3d26]
adc al, 0xe4
sub dh, bh
call 0xb4b914ca
fucomi st(2)
adc edi, dword [ecx - 0x2e]
mov dl, 0xc1
pop esi
int1
inc ebx
add eax, dword [ecx + 0x61457053]
inc ebp
mov byte [0x9cc827fe], al
and byte ds:[ebx + 0x119aa3a7], ah
enter 0x3e9c, 0xfffffffffffffff3
and byte [ebx + 0x119aa3a7], ah
pop es
adc al, ah
mov bh, 0xa4
movsb byte es:[edi], byte [esi]
push esi
xor dword [eax], eax
xchg edi, eax
push esi
sub eax, 0x1bb69d66
cmp ebx, dword [edx]
jg 0x561d8e
loopne 0x561d7d
adc eax, 0x2e7e97cf
mov ecx, 0x38473bab
jae 0x561e41
dec esp
dec edi
ja 0x561df9
pop esp
xchg esp, eax
test dword [edx], ecx
movsb byte es:[edi], byte [esi]
mov ds, word [ecx + edx*4 - 0x1e0e0038]
inc edi
cmp byte [ecx - 0x4a], 0xc8
in eax, dx
jne 0x561e35
enter 0x75ed, 0x38
fsub dword [esi]
xor eax, 0xc8e1cafe
inc eax
pop esp
inc eax
jge 0x561dfd
pop eax
invalid
jnp 0x561dc6
dec ebp
mov edi, 0xf172f48
popfd
mov byte [0x3d3368cf], al
movsd dword es:[edi], dword [esi]
and eax, 0x88530f00
xlatb
not dword [ebx + 0x19]
fbstp tbyte [edx - 0xb]
fidivr word [edx - 0x16]
dec eax
dec esi
shr byte [edi + 0x6666e350], cl
jbe 0x561de9
scasd eax, dword es:[edi]
push eax
jecxz 0x561e9f
jbe 0x561de9
int 0x7a
dec edx
dec ecx
out 3, al
adc eax, 0x8b80b7c6
add edx, dword [0x8b80b7c6]
pushal
or byte [eax - 0x20ee27e0], 0x89
xor edi, dword [ebp + 0x11]
jge 0x561e63
jge 0x561e63
sub dword [edx - 0x52437784], edi
aad 0xfd
invalid
xchg ebp, eax
fadd qword [ecx + 0x46]
mov edx, 0x7e6c08e1
sbb ebx, dword [ebp - 0x5d928af6]
loopne 0x561e11
jne 0x561edf
mov byte [0x12c69ce0], al
mov al, byte [0x42cc5d6d]
scasd eax, dword es:[edi]
push ds
iretd
invalid
pop ebp
jle 0x561e70
jmp 0x7e80e4b1
enter 0xffffffffffffd642, 0xfffffffffffffff3
dec esi
out 0xa4, al
fild qword [edi - 0x3f3323d0]
add bl, bh
invalid
Function at 0x5e21b0
Capabilities:
Encode data using xor

Disassembly:
or dword [esi], esi
jbe 0x5e21d5
into
arpl dx, bx
invalid
cwde
or byte [eax], bl
hlt
ficomp dword [eax - 0x720be7f8]
dec eax
shr dword [eax + 0x71f623b6], cl
and bl, 0xe0
mov ah, 0x9b
sbb al, 0xed
test byte [ebp - 0x44], dl
pop edi
add eax, 0xab592487
dec esi
loope 0x5e223b
out dx, eax
out 0x2e, eax
arpl bx, dx
mov esp, 0x563792cb
push ss
aaa
enter 0xffffffffffffa3b5, 0xffffffffffffffa7
or dword [ecx - 0xd], ecx
popal
aam 0xd4
shr dword [bx + 0x5705], cl
fnstcw word [edi + 0xe]
xor dword [edx], ecx
loope 0x5e2211
or eax, 0xd30bbc0f
inc esp
scasb al, byte es:[edi]
jnp 0x5e21aa
inc ebp
cmp al, 0x8a
xor byte [ebx + edx*4 + 0xf], bl
push ebp
mov edx, 0x63db2329
enter 0xffffffffffff9b9f, 0xffffffffffffffb2
mov byte [ebx - 0x2c], ah
cmp esi, dword cs:[edx]
dec ebx
inc edx
xor cl, byte [ebx + 0x42]
fldcw word [ebp - 0x25]
dec esi
in al, dx
movsd dword es:[edi], dword [esi]
push esi
pop ds
push edx
cmp ah, byte [ecx + edi]
pop ecx
inc eax
lea esp, [edx - 0x28]
jg 0x5e2213
and ebp, dword [0x692bd845]
mov edx, 0x5e9d03d5
invalid
pop ss
int 0x88
invalid
Function at 0x7fecf0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x959698]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x41c]
push ebp
mov ebp, dword [esp + 0x41c]
push esi
push edi
push eax
push 0
push 0
push ebp
push 0x8946f8
push 0
mov edi, ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
cmp esi, 0x20
ja 0x7fedef
lea ecx, [esp + 0xc]
push ecx
push str..htm
push 0x80000000
mov ecx, edi
call fcn.007fe2a0
test eax, eax
jne 0x7fee0d
push ebx
mov ebx, dword [0x88331c]
push str._shellopencommand
lea edx, [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
mov ecx, eax
push ecx
push 0x80000000
mov ecx, edi
call fcn.007fe2a0
test eax, eax
jne 0x7fee09
mov edi, dword [0x883470]
lea edx, [esp + 0x10]
push 0x8db8e0
push edx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x7fedca
lea eax, [esp + 0x10]
push 0x8db8d8
push eax
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x7fedc3
lea ecx, [esp + 0x10]
push ecx
call dword [0x8833d4]
lea esi, [esp + eax*2 + 0xe]
jmp 0x7fedcf
xor edx, edx
mov word [esi], dx
jmp 0x7fedcf
xor eax, eax
mov word [esi], ax
push 0x88982c
push esi
call ebx
push ebp
push esi
call ebx
mov ecx, dword [esp + 0x42c]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [0x883318]
pop ebx
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0082a330
add esp, 0x414
ret 8
mov eax, esi
jmp 0x7fedee
mov eax, esi
jmp 0x7fedef
Function at 0x7ffb10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x87bd4b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x959698]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
mov eax, dword [esi + 0x78]
add eax, 0xfffffffd
cmp eax, 5
ja case.0x7ffb4c.6
jmp dword [eax*4 + 0x7ffcd8]
mov eax, dword [esi + 0x7c]
push 5
push eax
call fcn.007fecf0
cmp eax, 0x20
jg 0x7ffbe0
push 0x30
call dword [0x88394c]
mov ecx, dword [esi + 0x7c]
push ecx
lea ecx, [esp + 0x1c]
call dword [0x88497c]
mov esi, eax
push 0x29dc
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call dword [0x88497c]
push esi
push eax
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x30], 1
call fcn.0040c5e0
add esp, 0xc
push 0
push 0x30
mov ecx, eax
mov byte [esp + 0x2c], 2
call dword [0x884e2c]
push eax
call fcn.0082834a
lea ecx, [esp + 0x2c]
call dword [0x884e34]
lea ecx, [esp + 0x14]
call dword [0x884e34]
lea ecx, [esp + 0x18]
call dword [0x884e34]
jmp case.0x7ffb4c.6
mov eax, dword [edi + 0x5c]
mov ebx, 1
mov ecx, edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
call fcn.007ff880
jmp case.0x7ffb4c.6
mov ecx, dword [esi + 0x7c]
push ecx
call dword [0x8834e0]
add esp, 4
mov ecx, edi
mov ebp, eax
call fcn.007ff880
call fcn.00828620
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov ebx, 1
push ebx
mov ecx, eax
mov eax, dword [edx + 0xac]
push ebp
call eax
mov ecx, dword [edi + 0x5c]
mov dword [esi + 0x60], ecx
jmp 0x7ffcbc
mov edx, dword [esi + 0x7c]
push edx
call dword [0x8834e0]
add esp, 4
mov ecx, edi
mov ebx, eax
call fcn.007ff880
call fcn.00828afa
test eax, eax
je 0x7ffc63
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x7c]
call eax
jmp 0x7ffc65
xor eax, eax
test edi, edi
jne 0x7ffc6d
xor ecx, ecx
jmp 0x7ffc70
mov ecx, dword [edi + 0x20]
mov edx, dword [eax + 0x20]
push ecx
movzx ecx, bx
push ecx
push 0x111
push edx
call dword [0x8839a0]
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x60], eax
mov ebx, 1
jmp 0x7ffcbc
test edi, edi
jne 0x7ffc99
xor eax, eax
jmp 0x7ffc9c
mov eax, dword [edi + 0x20]
mov ecx, dword [esi + 0x7c]
mov ebx, 1
push ebx
push 0
push 0
push ecx
push 0x8946f8
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [edi + 0x5c]
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x81fea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87eb09
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x959698]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x1d8]
mov eax, dword [esi + 0x1d4]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
call dword [0x884e24]
mov eax, dword [esp + 0x30]
sub eax, 0x100
mov dword [esp + 0x28], 0
mov edi, 0xfffffffe
je 0x81ff38
sub eax, 1
jne 0x81ffef
mov ecx, esi
call fcn.0081b4a0
test eax, eax
je 0x81ff2c
mov ecx, esi
call fcn.00828fd4
test eax, 0x10000000
je 0x81ff2c
test byte [esi + 0x284], 8
jne 0x81ffef
mov ecx, esi
call fcn.0081c760
jmp 0x81ffef
mov ecx, esi
call fcn.0081c760
cmp edi, dword [esi + 0xbc]
je 0x81ff91
lea edx, [esp + 0x10]
push edx
call dword [0x8839f0]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x8c]
mov dword [esp + 0x1c], ecx
test eax, eax
je 0x81ff7b
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x18]
push edx
push eax
call dword [0x8839fc]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0081bd90
mov edi, eax
cmp edi, dword [esi + 0xbc]
jne 0x81ffef
mov eax, dword [esi + 0x1d4]
mov ecx, dword [esi + 0x1d8]
cmp dword [esp + 0x10], eax
jne 0x81ffef
cmp dword [esp + 0x14], ecx
jne 0x81ffef
push edi
mov ecx, esi
call fcn.0081cb70
test eax, eax
je 0x81ffef
lea edx, [esp + 0x10]
push edx
call fcn.0081fc30
mov eax, dword [esi + 0x1cc]
test eax, eax
je 0x81ffe4
test byte [esi + 0x284], 0x10
jne 0x81ffe4
push 0
push eax
mov eax, dword [esi + 0x20]
push 0x101
push eax
call dword [0x883944]
push 1
push 1
mov ecx, esi
call fcn.0081b390
lea ecx, [esp + 0xc]
call dword [0x884e34]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x825280
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x959698]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x41c]
push ebx
mov ebx, dword [esp + 0x41c]
push esi
push eax
push 0
push 0
push ebx
push 0x8946f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
cmp esi, 0x20
ja 0x825380
lea ecx, [esp + 8]
push ecx
push str..htm
push 0x80000000
call fcn.00825170
add esp, 0xc
test eax, eax
jne 0x8253b1
push edi
mov edi, dword [0x88331c]
push str._shellopencommand
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 0xc]
push eax
mov ecx, eax
push ecx
push 0x80000000
call fcn.00825170
add esp, 0xc
test eax, eax
jne 0x825397
push ebp
mov ebp, dword [0x883470]
lea edx, [esp + 0x10]
push 0x8db8e0
push edx
call ebp
mov esi, eax
add esp, 8
test esi, esi
jne 0x82535a
lea eax, [esp + 0x10]
push 0x8db8d8
push eax
call ebp
mov esi, eax
add esp, 8
test esi, esi
jne 0x825353
lea ecx, [esp + 0x10]
push ecx
call dword [0x8833d4]
lea esi, [esp + eax*2 + 0xe]
jmp 0x82535f
xor edx, edx
mov word [esi], dx
jmp 0x82535f
xor eax, eax
mov word [esi], ax
push 0x88982c
push esi
call edi
push ebx
push esi
call edi
mov ecx, dword [esp + 0x42c]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [0x883318]
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0082a330
add esp, 0x414
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0082a330
add esp, 0x414
ret
mov ecx, dword [esp + 0x418]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0082a330
add esp, 0x414
ret
Function at 0x404880
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x28], 0xb25d
mov dword [ebp - 0x40], 0xe71
mov dword [ebp - 8], 0x114d4
mov dword [ebp - 0x3c], 0x4ae2
mov dword [ebp - 0x54], 0xd123
mov dword [ebp - 0x2c], 0x45a7
mov dword [ebp - 0x34], 0xa733
mov dword [ebp - 0x38], 0xaa30
mov dword [ebp - 0x20], 0xdfc3
mov dword [ebp - 0x44], 0xaad9
mov dword [ebp - 0x58], 0xe6e8
mov dword [ebp - 0x5c], 0x7818
mov dword [ebp - 0x24], 0x13ebe
mov dword [ebp - 0x60], 0x15412
mov dword [ebp - 0x50], 0x11a9e
mov dword [ebp - 0x64], 0x5939
mov dword [ebp - 0x48], 0x8c64
mov dword [ebp - 0x68], 0xfa3d
mov dword [ebp - 0x6c], 0x13ca3
mov dword [ebp - 0x4c], 0x143e5
mov dword [ebp - 4], 0x58c3
mov dword [ebp - 0x1c], 0x5185
mov dword [ebp - 0x30], 0x3b42
mov dword [ebp - 0xc], 0x12ef8
mov eax, dword [ebp - 0x28]
add eax, 0x8890
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x1020
push ecx
call fcn.0041a180
add esp, 8
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x30]
jge 0x40495a
mov dword [ebp - 0x14], 1
jmp 0x404961
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 4]
jge 0x404972
mov dword [ebp - 0x18], 1
jmp 0x404979
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 0x18]
je 0x404a05
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x3c]
jne 0x404a05
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x40]
jne 0x404a05
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jne 0x404a05
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x1c]
jne 0x404a05
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jne 0x404a05
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 4]
jge 0x4049d4
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x50]
jne 0x4049d4
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jne 0x4049d4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
push 0x11053
push 0xc5da
push 0x21ca
push 0x1572d
push 0x18141
push 0xb348
push 0x8b8d
push 0x14bf9
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
add esp, 0x20
mov dword [ebp - 0x10], 0
jmp 0x404a17
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x12ef7
cmp dword [ebp - 0x10], eax
jge 0x404a2f
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x404a0e
mov edx, dword [ebp - 0x2c]
sub edx, 1
mov dword [ebp - 0x2c], edx
mov esp, ebp
pop ebp
ret
Function at 0x406220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x4c], 0x15be8
mov dword [ebp - 0x2c], 0x14c22
mov dword [ebp - 0x50], 0xc0c2
mov dword [ebp - 0x3c], 0xa5d8
mov dword [ebp - 8], 0x34e9
mov dword [ebp - 0x1c], 0x78cc
mov dword [ebp - 0x34], 0x16ab1
mov dword [ebp - 0x38], 0x9c4d
mov dword [ebp - 0x30], 0x15b7e
mov dword [ebp - 0x44], 0x151db
mov dword [ebp - 0x28], 0x9fb6
mov dword [ebp - 0x24], 0x13674
mov dword [ebp - 0x54], 0x144eb
mov dword [ebp - 0x58], 0xdeed
mov dword [ebp - 0x20], 0x2dbc
mov dword [ebp - 0x5c], 0x12a2a
mov dword [ebp - 0x40], 0x15cda
mov dword [ebp - 0x60], 0x11b71
mov dword [ebp - 0x18], 0x83d8
mov dword [ebp - 0x64], 0x18462
mov dword [ebp - 0x68], 0x3783
mov dword [ebp - 0x48], 0x127ed
mov dword [ebp - 4], 0
jmp 0x4062d2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x11a90
cmp dword [ebp - 4], ecx
jge 0x406385
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp + 0x18]
je 0x406380
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jge 0x406380
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp + 0x18]
jne 0x406380
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x2c]
jne 0x406380
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jne 0x406380
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 8]
jne 0x406380
push 0x17b89
push 0x3ccb
push 0x1339b
push 0x1757f
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
add esp, 0x10
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x3c]
jge 0x40634a
mov dword [ebp - 0x10], 1
jmp 0x406351
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x44]
jge 0x406362
mov dword [ebp - 0x14], 1
jmp 0x406369
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 0x20]
add ecx, dword [ebp - 0x48]
or ecx, dword [ebp - 0x10]
or ecx, dword [ebp - 0x14]
je 0x406380
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
jmp 0x4062c9
mov dword [ebp - 0xc], 0
jmp 0x406397
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 0x15be7
cmp dword [ebp - 0xc], ecx
jge 0x4063b0
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jmp 0x40638e
mov esp, ebp
pop ebp
ret
Function at 0x406510
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x38], 0x6734
mov dword [ebp - 0x28], 0x168e6
mov dword [ebp - 4], 0x9045
mov dword [ebp - 0x20], 0xb3d1
mov dword [ebp - 0x30], 0xf8f4
mov dword [ebp - 0x24], 0x21f0
mov dword [ebp - 0x3c], 0x158fb
mov dword [ebp - 0x40], 0x12218
mov dword [ebp - 0x44], 0x16209
mov dword [ebp - 0x34], 0xa8ae
mov dword [ebp - 0x48], 0xe7b4
mov dword [ebp - 0x4c], 0x780b
mov dword [ebp - 0x50], 0x3ec6
mov dword [ebp - 0x1c], 0xa813
mov dword [ebp - 0x10], 0x16657
mov dword [ebp - 0x54], 0x12ccf
mov dword [ebp - 0x58], 0x37b7
mov dword [ebp - 0x5c], 0x5351
mov dword [ebp - 0x60], 0x3f17
mov dword [ebp - 0x64], 0x128a7
mov dword [ebp - 0x2c], 0x2443
mov dword [ebp - 0x18], 0x17720
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x18]
jge 0x4065ca
mov dword [ebp - 0xc], 1
jmp 0x4065d1
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 0x10]
imul edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
and eax, dword [ebp - 0xc]
or edx, eax
je 0x406642
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x10]
jne 0x406642
mov edx, dword [ebp + 8]
cmp edx, dword [ebp + 0x28]
jne 0x406642
mov eax, dword [ebp + 0x28]
cmp eax, dword [ebp - 0x30]
jge 0x406606
mov dword [ebp - 0x14], 1
jmp 0x40660d
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
and ecx, dword [ebp - 0x14]
je 0x406642
mov edx, dword [ebp + 0x24]
cmp edx, dword [ebp - 0x18]
jne 0x406642
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp + 0x18]
jne 0x406642
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
push 0x4344
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
add esp, 4
mov dword [ebp - 8], 0
jmp 0x406654
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
sub eax, 0x8499
cmp dword [ebp - 8], eax
jge 0x40666c
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x40664b
mov esp, ebp
pop ebp
ret