joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408298
Capabilities:
Set registry value

Disassembly:
mov eax, 0x43dad7
call fcn.0043c04c
sub esp, 0x94
push ebx
push esi
push edi
push 0xf
xor ebx, ebx
pop edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x80], bl
mov byte [ebp - 4], 1
push 0x12
push str.SoftwareGGSQGNA_
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 0x9c], bl
call fcn.00401f77
push 2
lea ecx, [ebp - 0x9c]
pop edx
lea esi, [ebp - 0x18]
call fcn.0040750e
push ebx
push 1
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 2
call fcn.00401bdc
push 7
push str.InstKey
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00401f77
mov dword [ebp - 0x10], 0xb31
cmp byte [ebp - 0x14], bl
je 0x408356
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x38]
jae 0x408343
lea eax, [ebp - 0x38]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push ebx
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.00401bdc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00407cf9
test al, al
je 0x4083ce
cmp dword [ebp - 0x44], ebx
jbe 0x4083ba
push 3
push 0x44273c
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00401f77
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x18]
call fcn.0040756c
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.00401bdc
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x54]
push eax
add ecx, 0xc
call fcn.00402295
cmp dword [ebp - 0x70], ebx
jbe 0x4083ce
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 8]
call fcn.00407e1a
mov dword [ebp - 0x1c], eax
sub esp, 0x10
mov dword [ebp - 0x10], esp
mov esi, esp
push ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x10], esp
call fcn.004047b9
mov eax, dword [ebp + 8]
add eax, 8
push 0xaba
push eax
mov dword [ebp + 8], eax
call fcn.00406127
push ecx
mov dword [ebp - 0x10], esp
lea esi, [ebp - 0x64]
mov dword [ebp - 0x10], esp
call fcn.004047b9
mov byte [ebp - 4], 3
push 6
push str.STATUS
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.00401f77
push dword [ebp - 0x1c]
lea eax, [ebp - 0x38]
push eax
mov edi, esi
mov byte [ebp - 4], 4
call fcn.00402fce
push ebx
push 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.00401bdc
sub esp, 0x10
mov dword [ebp - 0x10], esp
push esp
mov ecx, esi
call fcn.0040854f
push 0xa85
push dword [ebp + 8]
call fcn.00406127
mov eax, esi
push eax
mov byte [ebp - 4], 2
call fcn.00402f9f
cmp byte [ebp - 0x14], bl
je 0x408477
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00401bdc
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.00401bdc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x40a864
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [edi + 9], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi + 0xd], eax
call esi
push 1
mov dword [ebp - 8], eax
call esi
mov esi, dword [edi + 0xd]
mov ebx, dword [edi + 9]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
push 0
push esi
push ebx
fmul qword [0x4431e8]
call fcn.0043bfa0
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
neg esi
sub esi, ecx
add esi, eax
mov eax, ebx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 8]
cdq
sub eax, edx
push esi
sar ecx, 1
sar eax, 1
sub eax, ecx
push eax
push 0
push dword [edi + 5]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea esi, [edi + 0x11]
mov eax, esi
call fcn.00408c34
push dword [ebp + 0xc]
mov ebx, dword [esi]
push dword [ebp + 8]
call fcn.00408bc8
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push dword [edi + 5]
call esi
push 9
push dword [edi + 5]
call esi
push 0
push 0
push dword [edi + 5]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebx
leave
ret 8

Function at 0x40afa4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
xor eax, eax
xor edi, edi
push str.http:__go.gamenet.ru_a_60_722_inst
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], edi
mov word [ebp - 0x1c], ax
call fcn.0040852a
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x40afd6
lea eax, [ebp - 0x1c]
push 5
push edi
push edi
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x1c]
call fcn.00401cc1
push dword [esi + 0xcb]
mov dword [esi + 0xcf], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
leave
ret

Function at 0x40c442
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 4]
xor ecx, ecx
cmp dword [eax + 0xa3], ecx
je 0x40c46d
add eax, 0x93
cmp dword [eax + 0x14], 8
jb 0x40c45c
mov eax, dword [eax]
push 1
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x401d08
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x68edde], 0
jne 0x401f3f
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.00509a30
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401d5a
push ebx
call fcn.005080b0
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x401d87
push 0xb8
push 0x401614e
push 6
call fcn.005080bc
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.004018f7
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x401dcc
push ebx
call fcn.005080b0
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x401e00
push 0xb8
push 0x401614e
push 6
call fcn.005080bc
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x401e10
push ebx
call fcn.005080b0
add esp, 4
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x401e23
mov eax, 0x52b36d
push eax
push 1
mov ebx, 0x164
call fcn.00509a70
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.0040101b
mov dword [0x68edde], eax
cmp dword [0x68edde], 0
jne 0x401f3f
call fcn.00401f5f
mov dword [0x68edde], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x401e89
push 0x1c1
push 0x401614e
push 6
call fcn.005080bc
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.004018f7
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x401ece
push ebx
call fcn.005080b0
add esp, 4
push 0x80000301
push 0
push dword [0x68edde]
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x401f1f
push 0x1d6
push 0x401614e
push 6
call fcn.005080bc
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x401f2f
push ebx
call fcn.005080b0
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401f3f
push ebx
call fcn.005080b0
add esp, 4
mov eax, dword [0x68edde]
jmp 0x401f49
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401f5a
push ebx
call fcn.005080b0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x402d2e
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x68ede2], 0
jne 0x402dd9
mov eax, str._dbg.g_threadCallStack_tls
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00402e5b
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402d6f
push ebx
call fcn.005080b0
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x68ede2], eax
cmp dword [0x68ede2], 0
jne 0x402dd9
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x402dad
push 0xd2
push 0x40161bd
push 6
call fcn.005080bc
add esp, 0xc
mov dword [0x68ede2], eax
push dword [0x68ede2]
mov eax, str._dbg.g_threadCallStack_tls
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004032a1
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402dd9
push ebx
call fcn.005080b0
add esp, 4
mov dword [ebp - 8], esp
push dword [0x68ede2]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x402e08
push 0x163
push 0x40161bd
push 6
call fcn.005080bc
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402e4f
call fcn.0040339c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x68ede2]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x402e4f
push 0x1e1
push 0x40161bd
push 6
call fcn.005080bc
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x402e57
mov esp, ebp
pop ebp
ret
Function at 0x402e89
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x68ede6], 0
jne 0x4030c0
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.00509a30
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402edb
push ebx
call fcn.005080b0
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x402f08
push 0xb8
push 0x40161da
push 6
call fcn.005080bc
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.004018f7
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x402f4d
push ebx
call fcn.005080b0
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x402f81
push 0xb8
push 0x40161da
push 6
call fcn.005080bc
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x402f91
push ebx
call fcn.005080b0
add esp, 4
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402fa4
mov eax, 0x52b36d
push eax
push 1
mov ebx, 0x164
call fcn.00509a70
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.0040101b
mov dword [0x68ede6], eax
cmp dword [0x68ede6], 0
jne 0x4030c0
call fcn.004030e0
mov dword [0x68ede6], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x40300a
push 0x1c1
push 0x40161da
push 6
call fcn.005080bc
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.004018f7
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40304f
push ebx
call fcn.005080b0
add esp, 4
push 0x80000301
push 0
push dword [0x68ede6]
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x4030a0
push 0x1d6
push 0x40161da
push 6
call fcn.005080bc
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4030b0
push ebx
call fcn.005080b0
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4030c0
push ebx
call fcn.005080b0
add esp, 4
mov eax, dword [0x68ede6]
jmp 0x4030ca
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4030db
push ebx
call fcn.005080b0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40378e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 4], esp
je 0x4037d2
push 0x12
push 0x40161cd
push 6
call fcn.005080bc
add esp, 0xc
jmp 0x4037d7
mov esp, ebp
pop ebp
ret 4

Function at 0x40409e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 4], esp
je 0x4040e2
push 0x12
push 0x401612b
push 6
call fcn.005080bc
add esp, 0xc
jmp 0x4040e7
mov esp, ebp
pop ebp
ret 4
Function at 0x408676
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x68edfa], 0
jne 0x408721
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00401cda
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4086b7
push ebx
call fcn.005080b0
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x68edfa], eax
cmp dword [0x68edfa], 0
jne 0x408721
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x4086f5
push 0xc6
push 0x401614a
push 6
call fcn.005080bc
add esp, 0xc
mov dword [0x68edfa], eax
push dword [0x68edfa]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00402190
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408721
push ebx
call fcn.005080b0
add esp, 4
mov dword [ebp - 8], esp
push dword [0x68edfa]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x408750
push 0x138
push 0x401614a
push 6
call fcn.005080bc
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x408797
call fcn.00401f5f
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x68edfa]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x408797
push 0x1b6
push 0x401614a
push 6
call fcn.005080bc
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x40879f
mov esp, ebp
pop ebp
ret

Function at 0x408b33
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x68edfe], 0
jne 0x408bde
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00408c60
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408b74
push ebx
call fcn.005080b0
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x68edfe], eax
cmp dword [0x68edfe], 0
jne 0x408bde
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x408bb2
push 0xc6
push 0x40161ae
push 6
call fcn.005080bc
add esp, 0xc
mov dword [0x68edfe], eax
push dword [0x68edfe]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004090a6
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408bde
push ebx
call fcn.005080b0
add esp, 4
mov dword [ebp - 8], esp
push dword [0x68edfe]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x408c0d
push 0x138
push 0x40161ae
push 6
call fcn.005080bc
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x408c54
call fcn.00408ee5
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x68edfe]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x408c54
push 0x1b6
push 0x40161ae
push 6
call fcn.005080bc
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x408c5c
mov esp, ebp
pop ebp
ret
Function at 0x408c8e
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x68ee02], 0
jne 0x408ec5
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.00509a30
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x408ce0
push ebx
call fcn.005080b0
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x408d0d
push 0xb8
push 0x40161b2
push 6
call fcn.005080bc
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.004018f7
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408d52
push ebx
call fcn.005080b0
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x408d86
push 0xb8
push 0x40161b2
push 6
call fcn.005080bc
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408d96
push ebx
call fcn.005080b0
add esp, 4
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x408da9
mov eax, 0x52b36d
push eax
push 1
mov ebx, 0x164
call fcn.00509a70
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.0040101b
mov dword [0x68ee02], eax
cmp dword [0x68ee02], 0
jne 0x408ec5
call fcn.00408ee5
mov dword [0x68ee02], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x408e0f
push 0x1c1
push 0x40161b2
push 6
call fcn.005080bc
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.004018f7
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408e54
push ebx
call fcn.005080b0
add esp, 4
push 0x80000301
push 0
push dword [0x68ee02]
push 1
mov ebx, 0x168
call fcn.00509780
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x408ea5
push 0x1d6
push 0x40161b2
push 6
call fcn.005080bc
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408eb5
push ebx
call fcn.005080b0
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x408ec5
push ebx
call fcn.005080b0
add esp, 4
mov eax, dword [0x68ee02]
jmp 0x408ecf
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x408ee0
push ebx
call fcn.005080b0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x409de4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x52b4ef
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 8], esp
je 0x409e22
push 0x36
push 0x40160dc
push 6
call fcn.005080bc
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push str.NtQueryInformationThread
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x409e56
push 0x36
push 0x40160dc
push 6
call fcn.005080bc
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x409f50
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop
nop
cmp dword [ebp - 8], esp
je 0x409e8c
push 0x94
push 0x40160dc
push 6
call fcn.005080bc
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 9
push dword [ebp - 0xc]
xor eax, eax
call dword [0x68f21a]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x409ed5
push 0x94
push 0x40160dc
push 6
call fcn.005080bc
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x409f50
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 8], esp
je 0x409f0d
push 0x132
push 0x40160dc
push 6
call fcn.005080bc
add esp, 0xc
push eax
call fcn.00409f84
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x14], eax
jne 0x409f50
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x40a921
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], 0
call fcn.004097a5
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x40aa4d
mov eax, 0x52b804
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004040ed
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40a967
push ebx
call fcn.005080b0
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [0x68edf6]
push 1
mov ebx, 0x9dc
call fcn.00509ec0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
push 1
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00404109
lea eax, [ebp - 4]
push eax
call fcn.004041a1
call fcn.00409d51
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x40aa69
push 0
call fcn.00409de4
mov dword [ebp - 8], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]