joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ebb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x49ebd1
cmp eax, edi
jge 0x49ebc9
call fcn.0049e420
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor eax, eax
cmp dword [esi + 8], eax
jle 0x49ebfc
lea ecx, [eax - 8]
jmp 0x49ebe0
mov dl, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], ecx
mov byte [esp + eax + 0xc], dl
add eax, 1
cmp dword [esi + 8], 0
jg 0x49ebe0
cmp eax, 4
jge 0x49ec1f
mov edi, dword [esi + 4]
mov edx, dword [esi]
cmp edx, edi
jb 0x49ec09
xor ecx, ecx
jmp 0x49ec11
mov cl, byte [edx]
add edx, 1
movzx ecx, cl
mov byte [esp + eax + 0xc], cl
add eax, 1
cmp eax, 4
jl 0x49ec01
mov dword [esi], edx
mov eax, dword [esp + 0xc]
movzx ecx, byte [esp + 0xf]
movzx edx, byte [esp + 0xe]
movzx ebx, ah
movzx eax, al
shl ebx, 8
add ebx, eax
shl ecx, 8
mov eax, ebx
add ecx, edx
xor eax, 0xffff
cmp ecx, eax
je 0x49ec59
mov dword [0x4fd488], str.zlib_corrupt
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esi]
add ecx, ebx
cmp ecx, dword [esi + 4]
jbe 0x49ec73
pop edi
pop esi
mov dword [0x4fd488], 0x4e5af8
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esi + 0x10]
add edx, ebx
cmp edx, dword [esi + 0x18]
jbe 0x49ec8a
mov ecx, ebx
mov edi, esi
call fcn.0049e460
test eax, eax
je 0x49ec52
mov edi, dword [esi]
push ebp
mov ebp, dword [esi + 0x10]
push ebx
push edi
push ebp
call fcn.004b1120
add esp, 0xc
add edi, ebx
add ebp, ebx
mov dword [esi + 0x10], ebp
pop ebp
mov dword [esi], edi
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4a81f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov dword [ebx + 0x20], eax
push edi
lea esi, [esp + 0xc]
mov eax, ebx
call fcn.004a81a0
mov ecx, dword [ebx + 0x20]
cmp byte [ecx + 0x535], 0
mov esi, 0x40000080
je 0x4a821e
mov esi, 0x400000a0
mov edx, dword [ecx]
mov eax, dword [edx + 0x124]
call eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0x178]
sub edx, ecx
push edx
mov edx, dword [esp + 0x10]
sub edi, edx
push edi
push ecx
push edx
push 0
push esi
push 0
push eax
mov eax, ebx
call fcn.00466220
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0x124]
call eax
mov edi, eax
call fcn.0046ba30
mov ecx, dword [eax]
mov edx, dword [ebx + 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push ecx
push 0x30
push edx
call esi
mov eax, dword [ebx + 0x20]
mov ecx, dword [eax + 0x530]
mov edx, dword [ebx + 4]
push 0
push ecx
push 0xc5
push edx
call esi
mov eax, dword [ebx + 0x20]
cmp byte [eax + 0x535], 0
je 0x4a82b2
movzx eax, word [eax + 0x536]
mov ecx, dword [ebx + 4]
push 0
push eax
push 0xcc
push ecx
call esi
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 0x168]
lea eax, [esp + 0xc]
push eax
call edx
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x4a82d3
mov eax, dword [eax + 4]
jmp 0x4a82d6
add eax, 4
push eax
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [esp + 0x24], edi
jb 0x4a82f4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004a93cc
add esp, 4
mov edx, dword [ebx + 4]
push 0
push 0
push 0xb9
push edx
call esi
mov eax, dword [ebx + 4]
push 0
push 3
push 0xd3
push eax
call esi
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0x11c]
call eax
mov edx, dword [ebx + 4]
movzx ecx, al
push ecx
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0x20]
movzx ecx, byte [eax + 0x534]
mov edx, dword [ebx + 4]
push 0
push ecx
push 0xcf
push edx
call esi
mov eax, dword [ebx + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 4]
pop edi
pop esi
pop ebx
add esp, 0x1c
mov dword [esp + 4], ecx
jmp dword [sym.imp.USER32.dll_SetFocus]
Function at 0x4a8370
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccec8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4fa36c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
add edi, 1
lea eax, [edi + edi]
call fcn.004aeaa0
mov esi, esp
test esi, esi
je 0x4a842f
mov ecx, dword [ebx + 4]
push edi
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor edi, edi
mov eax, esi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], di
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4a83e0
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [ebp - 0x2c]
call fcn.004018b0
push 0xffffffffffffffff
mov dword [ebp - 4], edi
mov esi, dword [ebx + 0x20]
push edi
lea edx, [ebp - 0x2c]
push edx
lea eax, [esi + 0x36c]
call fcn.004017c0
mov eax, dword [esi]
mov edx, dword [eax + 0x118]
mov ecx, esi
call edx
cmp dword [ebp - 0x14], 8
jb 0x4a842f
mov eax, dword [ebp - 0x28]
push eax
call fcn.004a93cc
add esp, 4
xor eax, eax
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a9ce9
mov esp, ebp
pop ebp
ret 4
Function at 0x4a86c0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cac80
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fa36c]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x6c]
mov eax, dword [esp + 0x68]
xor ebp, ebp
mov dword [esp + 0x60], ebp
cmp dword [eax + 0x18], 8
jb 0x4a8700
mov eax, dword [eax + 4]
jmp 0x4a8703
add eax, 4
push ebp
push 0x80
push 3
push ebp
push 3
push Ordinal_4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x68], esi
je 0x4a873d
lea edi, [esp + 0x1c]
lea eax, [esp + 0x68]
call fcn.00440400
test al, al
jne 0x4a8753
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
mov edi, dword [esp + 0x1c]
lea esi, [esp + 0x28]
mov dword [esp + 0x28], 0x4d809c
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
call fcn.00401c90
mov byte [esp + 0x60], 1
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x4a87b6
mov ecx, dword [esp + 0x68]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebp
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a87ad
cmp dword [esp + 0x18], 0
seta al
test al, al
jne 0x4a87d7
push ebp
call fcn.004a970e
add esp, 4
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
mov esi, ebx
call fcn.00401c90
mov eax, dword [ebx + 4]
cmp edi, eax
ja 0x4a87e7
mov eax, edi
mov dword [ebx + 0xc], eax
lea eax, [esp + 0x38]
call fcn.004401e0
mov eax, dword [ebx + 8]
push 0
push eax
push ebp
lea eax, [esp + 0x44]
push eax
mov eax, edi
call fcn.00440260
test al, al
lea ecx, [esp + 0x28]
jne 0x4a8832
call fcn.00401c60
lea esi, [esp + 0x68]
call fcn.00440350
xor al, al
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
call fcn.00401c60
mov ecx, dword [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret

Function at 0x4a9ce9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4fa36c]
jne 0x4a9cf3
repz ret
jmp fcn.004b397d
Function at 0x4ac662
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4ac69f
cmp dword [ebp + 0x14], edi
je 0x4ac69f
cmp ecx, edi
jne 0x4ac6a6
call fcn.004abebb
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004ab56d
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4ac6ba
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4ac6db
cmp ebx, 0xffffffff
je 0x4ac6ca
push ebx
push edi
push ecx
call fcn.004aef60
add esp, 0xc
cmp esi, edi
je 0x4ac687
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4ac687
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4ac6f7
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4ac6fe
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4ac7ef
test word [esi + 0xc], 0x10c
je 0x4ac752
mov eax, dword [esi + 4]
test eax, eax
je 0x4ac752
jl 0x4ac850
cmp ebx, eax
mov edi, ebx
jb 0x4ac723
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4ac7f7
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004a93d1
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4ac7e7
cmp ebx, dword [ebp - 0xc]
jb 0x4ac7bf
cmp dword [ebp - 0xc], 0
je 0x4ac77c
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4ac771
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4ac778
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4ac787
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4ac787
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4ac823
push eax
push dword [ebp - 8]
push esi
call fcn.004b509f
pop ecx
push eax
call fcn.004bbc54
add esp, 0xc
test eax, eax
je 0x4ac862
cmp eax, 0xffffffff
je 0x4ac850
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4ac7e7
push esi
call fcn.004b4d3f
cmp eax, 0xffffffff
pop ecx
je 0x4ac854
cmp dword [ebp - 4], 0
je 0x4ac823
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4ac706
mov eax, dword [ebp + 0x14]
jmp 0x4ac6a1
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4ac80e
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004aef60
add esp, 0xc
call fcn.004abebb
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4ac697
cmp dword [ebp + 0xc], 0xffffffff
je 0x4ac839
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004aef60
add esp, 0xc
call fcn.004abebb
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4ac697
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4ac6a1
or dword [esi + 0xc], 0x10
jmp 0x4ac854
Function at 0x4b3a81
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4fa9f0]
je 0x4b3a9c
inc edi
cmp edi, 0x17
jb 0x4b3a8d
cmp edi, 0x17
jae 0x4b3c1c
push ebp
push 3
call fcn.004c1d18
cmp eax, 1
pop ecx
je 0x4b3be8
push 3
call fcn.004c1d18
test eax, eax
pop ecx
jne 0x4b3ad0
cmp dword [0x4fa1b0], 1
je 0x4b3be8
cmp ebx, 0xfc
je 0x4b3c1b
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4fc868
push ebp
call fcn.004b3918
add esp, 0xc
test eax, eax
je 0x4b3b06
push esi
push esi
push esi
push esi
push esi
call fcn.004ab471
add esp, 0x14
push 0x104
mov esi, 0x4fc881
push esi
push 0
mov byte [0x4fc985], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b3b4a
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004b3918
add esp, 0xc
test eax, eax
je 0x4b3b4a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004ab471
add esp, 0x14
push esi
call fcn.004aefe0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4b3b8f
push esi
call fcn.004aefe0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4fcb7c
push 0x4d6bcc
sub ecx, eax
push ecx
push eax
call fcn.004bf6f2
add esp, 0x14
test eax, eax
je 0x4b3b8f
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004ab471
add esp, 0x14
jmp 0x4b3b91
xor esi, esi
push 0x4d6bc8
push ebx
push ebp
call fcn.004bf681
add esp, 0xc
test eax, eax
je 0x4b3bb1
push esi
push esi
push esi
push esi
push esi
call fcn.004ab471
add esp, 0x14
push dword [edi*8 + 0x4fa9f4]
push ebx
push ebp
call fcn.004bf681
add esp, 0xc
test eax, eax
je 0x4b3bd3
push esi
push esi
push esi
push esi
push esi
call fcn.004ab471
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004c1b5b
add esp, 0xc
jmp 0x4b3c1b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4b3c1b
cmp ebp, 0xffffffff
je 0x4b3c1b
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4fa9f4]
push dword [esi]
call fcn.004aefe0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4c1b5b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004b31ef
xor ebx, ebx
cmp dword [0x4fd038], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4c1c31
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4c1d11
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4c1d11
push eax
call fcn.004b3181
mov dword [esp], 0x4d7f98
push edi
mov dword [0x4fd038], eax
call esi
push eax
call fcn.004b3181
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4fd03c], eax
call esi
push eax
call fcn.004b3181
mov dword [0x4fd040], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004af4a6
test eax, eax
pop ecx
pop ecx
je 0x4c1bff
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ab471
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4c1c31
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004b3181
cmp eax, ebx
pop ecx
mov dword [0x4fd048], eax
je 0x4c1c31
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b3181
pop ecx
mov dword [0x4fd044], eax
mov eax, dword [0x4fd044]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4c1cb6
cmp dword [0x4fd048], ecx
je 0x4c1cb6
push eax
call fcn.004b31f8
push dword [0x4fd048]
mov esi, eax
call fcn.004b31f8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4c1cb6
cmp edi, ebx
je 0x4c1cb6
call esi
cmp eax, ebx
je 0x4c1c83
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4c1c83
test byte [ebp - 0x18], 1
jne 0x4c1cb6
lea eax, [ebp - 0x10]
push eax
call fcn.004af4dd
test eax, eax
pop ecx
je 0x4c1c9e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ab471
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4c1cad
or dword [ebp + 0x10], 0x200000
jmp 0x4c1cf1
or dword [ebp + 0x10], 0x40000
jmp 0x4c1cf1
mov eax, dword [0x4fd03c]
cmp eax, dword [ebp - 8]
je 0x4c1cf1
push eax
call fcn.004b31f8
cmp eax, ebx
pop ecx
je 0x4c1cf1
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4c1cf1
mov eax, dword [0x4fd040]
cmp eax, dword [ebp - 8]
je 0x4c1cf1
push eax
call fcn.004b31f8
cmp eax, ebx
pop ecx
je 0x4c1cf1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4fd038]
call fcn.004b31f8
cmp eax, ebx
pop ecx
je 0x4c1d11
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4c1d13
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x13a21c60
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x13ae8430]
test eax, eax
jne 0x13a21cdb
mov dword [0x13ae8430], 1
call fcn.13a47650
test eax, eax
je 0x13a21ccb
push 0
push 0x104
push 0x13ae8434
call fcn.13a4ac00
add esp, 0xc
test eax, eax
je 0x13a21cdb
push esi
push edi
mov edi, 0x13ad138c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x13ae8434
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 0x13ae8434
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x104
push 0x13ae8434
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x13ae8434
ret

Function at 0x13a22fc0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13a2301e
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x13a22ffa
push esi
call fcn.13a57953
add esp, 4
lea eax, [eax + eax + 2]
jmp 0x13a22ffc
xor eax, eax
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 8]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret 0xc

Function at 0x13a23030
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13a23077
mov ecx, dword [esp]
lea edx, [esp + 0x10]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret 0xc

Function at 0x13a23080
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push 0x80000002
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13a2311a
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x13a23104
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.13a57ae6
mov esi, eax
add esp, 4
test esi, esi
je 0x13a23104
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x13a23130
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push 0x80000002
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13a231c7
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
test eax, eax
jne 0x13a231b1
mov eax, dword [esp + 0x18]
cmp eax, 1
jb 0x13a231b1
inc eax
push eax
mov dword [esp + 0x1c], eax
call fcn.13a57ae6
mov esi, eax
add esp, 4
test esi, esi
je 0x13a231b1
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push esi
push eax
push 0
push edi
push ecx
call ebx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8

Function at 0x13a231d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13a23234
mov dword [esp + 8], eax
lea edx, [esp + 0x10]
lea eax, [esp + 4]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0xc
ret 8
Function at 0x13a24600
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
jne 0x13a24617
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx]
xor edx, edx
mov edi, dword [eax + 8]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + edi + 0x78]
mov ecx, dword [eax + edi + 0x1c]
add eax, edi
add ecx, edi
mov dword [ebp - 0x14], ecx
mov ebx, dword [eax + 0x18]
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add ecx, edi
add eax, edi
cmp ebx, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
jbe 0x13a246c6
mov dword [ebp - 4], ecx
mov eax, dword [ecx]
mov esi, dword [ebp + 8]
add eax, edi
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x13a2468f
test cl, cl
je 0x13a2468b
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x13a2468f
add eax, 2
add esi, 2
test cl, cl
jne 0x13a2466b
xor eax, eax
jmp 0x13a24694
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x13a246b5
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc edx
add ecx, 4
cmp edx, eax
mov dword [ebp - 4], ecx
jb 0x13a24664
mov esi, dword [ebp - 0xc]
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov ax, word [ecx + edx*2]
mov edx, dword [ebp - 0x14]
mov esi, dword [edx + eax*4]
add esi, edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x13a2a7d0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x13abb630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x13a2a8a6
push str.msedgewebview2.exe
push eax
call fcn.13a58070
add esp, 8
test eax, eax
jne 0x13a2a8a6
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x13a2a8a6
push str.___webview_exe_namems_teams.exe
push eax
call fcn.13a3b330
add esp, 8
test eax, eax
je 0x13a2a8a6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.13a7de20
push eax
lea eax, [esp + 8]
push eax
call fcn.13a7df80
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push eax
mov dword [esp + 0x10], 0
call fcn.13a34330
lea ecx, [esp]
mov byte [esp + 0xc], 2
call fcn.13a2f8b0
mov ecx, dword [esp + 0x14]
push str.msedgewebview2.exe
push ecx
call fcn.13a57b6d
add esp, 8
mov dword [esp + 0xc], 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
je 0x13a2a8a1
call fcn.13a34c30
mov eax, 1
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
call fcn.13a34c30
mov ecx, dword [esp + 4]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x10
ret 4