joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cad0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x43cc23
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0043c9d0
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x43cbf6
movzx eax, byte [ecx + 8]
mov edx, dword [edx]
xor eax, 0x811c9dc5
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp - 4], eax
cmp ebx, esi
jne 0x43cb6e
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x43cbe9
mov eax, dword [eax + 4]
movzx edi, word [ecx + 8]
cmp di, word [eax + 8]
jne 0x43cbaa
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x43cba2
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ecx
jmp 0x43cbe9
mov edi, eax
cmp ebx, eax
je 0x43cbc6
mov eax, dword [eax + 4]
mov edi, eax
movzx esi, word [ecx + 8]
cmp si, word [eax + 8]
mov esi, dword [ebp + 8]
je 0x43cbff
cmp ebx, eax
jne 0x43cbb0
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x43cb32
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x43cbe9
push str.invalid_hash_bucket_count
call fcn.004498c9
int3
Function at 0x44f4f3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d6ec
push 0x45d6e4
push str.FlsAlloc
push 0x1e
call fcn.0044f3d1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f527
push dword [ebp + 8]
mov ecx, esi
call dword [0x459308]
call esi
jmp 0x44f52d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44f571
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d6fc
push 0x45d6f4
push str.FlsGetValue
push 0x20
call fcn.0044f3d1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f5a8
push dword [ebp + 8]
mov ecx, esi
call dword [0x459308]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x450e3b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x450ed8
push ebx
push esi
call fcn.00450e04
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044f1a4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x450e85
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x450ed7
push edi
push eax
call fcn.0044ee91
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x450ea5
call fcn.0044ee57
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x450ed6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044f1a4
add esp, 0x20
test eax, eax
jne 0x450ec4
push edi
call fcn.0044ee57
jmp 0x450ecc
push ebx
call fcn.0044ee57
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x20001930
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
mov eax, dword [ebx + 4]
mov ebp, ecx
cmp eax, 0xffffffff
jne 0x2000194e
call fcn.20006150
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4
push 0
push 0x80
push 3
push 0
push 1
lea eax, [ebp + 0x178]
push 0x80000000
push eax
call dword [0x2001a230]
mov edi, eax
cmp edi, 0xffffffff
jne 0x2000197c
pop edi
pop ebp
or eax, eax
pop ebx
ret 4
mov ecx, dword [ebx + 4]
push esi
push 0
push ebx
push ecx
push edi
call dword [sym.imp.IMM32.dll_ImmGetContext]
push 0x2000
push 0x40
mov dword [esp + 0x1c], 0
call dword [0x2001a25c]
mov esi, eax
lea ecx, [esp + 0x14]
push 0
push ecx
mov byte [esi], 0x6a
mov edx, dword [ebx]
mov dword [esi + 1], edx
mov eax, dword [ebx + 4]
lea edx, [esi + 9]
push 0x1ff7
push edx
push edi
mov dword [esi + 5], eax
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
push edi
call dword [0x2001a304]
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x200019f4
add eax, 9
mov ecx, ebp
push eax
push esi
call fcn.20007e00
push esi
mov edi, eax
call dword [0x2001a264]
mov eax, edi
pop esi
pop edi
pop ebp
pop ebx
ret 4
mov ecx, ebp
call fcn.20006150
mov edi, dword [esp + 0x14]
push esi
call dword [0x2001a264]
mov eax, edi
pop esi
pop edi
pop ebp
pop ebx
ret 4

Function at 0x20002430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.200146e0
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x20002484
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x20002453
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x200024d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x58c
mov eax, dword [0x200212e4]
push ebx
push esi
mov esi, dword [esp + 0x5a0]
push edi
mov ecx, 0xa1
lea edi, [esp + 0x78]
mov ebx, dword [esp + 0x59c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x2f0]
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x288], ecx
mov dword [esp + 0x14], edx
lea eax, [esp + 0xc]
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], edx
mov edx, dword [ebx + 0xc0]
push eax
push ecx
push edx
mov dword [esp + 0x18], 0x10
call dword [0x2001a5b8]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x5a0]
mov esi, dword [0x2001a324]
push 6
lea edx, [esp + 0x170]
push 0x2002243c
push edx
mov dword [esp + 0x128], eax
mov dword [esp + 0x160], ecx
call esi
add esp, 0xc
call sym.drmclien.dll_DllRegisterServer
mov dword [esp + 0x172], eax
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0x40
push eax
call dword [0x2001a11c]
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ecx, 0x14
call fcn.20019510
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x48]
mov ecx, 0x14
call fcn.20019510
mov ecx, dword [0x200212e4]
push 0x101
add ecx, 0x2fe
lea edx, [esp + 0x17a]
push ecx
push edx
mov dword [esp + 0x16c], eax
call esi
mov eax, dword [0x200212e4]
push 0x31
add eax, 0x4fc
lea ecx, [esp + 0x29c]
push eax
push ecx
call esi
mov eax, dword [0x200212e4]
add esp, 0x18
lea ecx, [esp + 0x30]
mov edx, dword [eax + 0x4f8]
push ecx
mov dword [esp + 0x284], edx
mov eax, dword [eax + 0x4f4]
mov dword [esp + 0x280], eax
lea edx, [esp + 0x2c]
lea eax, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x2f5]
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dl, byte [0x20024148]
mov ecx, dword [0x20024034]
mov eax, dword [0x20024030]
mov byte [esp + 0x2f1], dl
lea edx, [esp + 0x78]
mov dword [esp + 0x2f8], ecx
push 0x51f
push edx
mov ecx, ebx
mov dword [esp + 0x2fc], eax
call fcn.200101b0
pop edi
pop esi
pop ebx
add esp, 0x58c
ret
Function at 0x20004210
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x24c
push esi
mov dword [esp + 4], 0
call fcn.200134d0
mov esi, eax
test esi, esi
jne 0x20004232
pop esi
add esp, 0x24c
ret
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x128]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x194]
push eax
push ecx
push esi
push 0
mov dword [esp + 0x30], 0x64
mov dword [esp + 0x2c], 0xc8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x200042bc
push 0x20021138
call dword [0x2001a2d4]
push 0x20021120
push eax
call dword [0x2001a22c]
test eax, eax
je 0x200042bc
lea edx, [esp + 0xc]
lea ecx, [esp + 0x188]
push edx
push ecx
call eax
test eax, eax
je 0x200042bc
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
push edx
push eax
push 0x80000003
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x2001a264]
push esi
call fcn.20019410
mov eax, dword [esp + 8]
add esp, 4
test eax, eax
jne 0x200043f2
push ebx
push ebp
lea edx, [esp + 0x20]
push edi
xor ebp, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edx
push ebp
push ebp
lea eax, [esp + 0x20]
push ebp
lea ecx, [esp + 0x40]
push eax
push ecx
push ebp
push 0x80000003
mov dword [esp + 0x34], 0xff
call ebx
cmp eax, 0x103
je 0x200043ef
test eax, eax
jne 0x200043be
lea edx, [esp + 0x30]
push 0x2d
push edx
call dword [0x2001a33c]
mov edi, eax
push 9
lea eax, [esp + 0x3c]
push 0x2002123c
push eax
call dword [0x2001a37c]
add esp, 0x14
test eax, eax
jne 0x200043be
mov esi, 0x20021238
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x20004368
test cl, cl
je 0x20004364
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x20004368
add eax, 2
add esi, 2
test cl, cl
jne 0x20004344
xor eax, eax
jmp 0x2000436d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x200043a5
mov esi, 0x20021230
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x2000439c
test cl, cl
je 0x20004398
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x2000439c
add eax, 2
add esi, 2
test cl, cl
jne 0x20004378
xor eax, eax
jmp 0x200043a1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x200043be
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0x80000003
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
test eax, eax
je 0x200043ef
lea edx, [esp + 0x24]
lea eax, [esp + 0x14]
push edx
push 0
push 0
push 0
lea ecx, [esp + 0x40]
inc ebp
push eax
push ecx
push ebp
push 0x80000003
mov dword [esp + 0x34], 0xff
call ebx
cmp eax, 0x103
jne 0x20004309
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 4]
pop esi
add esp, 0x24c
ret
Function at 0x20004860
Capabilities:
Get networking parameters

Disassembly:
push 0xffffffffffffffff
push 0x20019b66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.20012f40
lea edi, [esi + 0x144]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call sym.drmclien.dll_Encrypt
mov al, byte [esp + 0x24]
mov byte [esp + 0x18], 1
cmp al, bl
mov dword [esi], 0x2001abec
mov dword [esi + 0x16c], ebx
mov byte [esi + 0x170], al
jne 0x200048d2
push 0x20024cc8
push 0x100
call dword [sym.imp.iphlpapi.dll_GetNetworkParams]
mov ecx, esi
call fcn.20006a60
push ebx
mov ecx, edi
call fcn.20007f30
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x174], eax
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x20004e50
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x20019af8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x2001abe4
mov edi, dword [0x2001a2d0]
lea eax, [esi + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0
call edi
lea ecx, [esi + 0x10]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov edi, dword [0x2001a2a4]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x2c]
mov edi, dword [0x2001a304]
push ecx
call edi
mov edx, dword [esi + 0x30]
push edx
call edi
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x20004ec7
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.2000f6a0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x200057a0
Capabilities:
Delete file

Disassembly:
sub esp, 0x130
push ebx
mov ebx, ecx
mov ecx, dword [0x20021168]
push esi
mov dword [esp + 0xc], ecx
mov cx, word [0x20021174]
push edi
mov word [esp + 0x1c], cx
mov ecx, 6
mov esi, 0x20021148
lea edi, [esp + 0x20]
mov eax, dword [0x20021164]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x2002116c]
mov dword [esp + 0xc], eax
mov eax, dword [0x20021170]
mov dword [esp + 0x14], edx
mov dl, byte [0x20021176]
mov ecx, ebx
movsw word es:[edi], word [esi]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1e], dl
movsb byte es:[edi], byte [esi]
call fcn.200103a0
push eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x40]
push eax
push ecx
call dword [0x2001a4dc]
add esp, 0xc
lea edx, [esp + 0x3c]
mov ecx, ebx
push edx
call fcn.20014b30
mov esi, eax
test esi, esi
je 0x2000583f
mov ax, word [esi]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, ebx
call fcn.20002680
mov edx, dword [esi + 4]
push edx
call sub.KERNEL32.dll_DeleteFileA
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.20014b30
mov esi, eax
test esi, esi
je 0x20005869
mov cx, word [esi]
mov edx, dword [esi + 4]
push ecx
push edx
mov ecx, ebx
call fcn.20002680
mov eax, dword [esi + 4]
push eax
call sub.KERNEL32.dll_DeleteFileA
pop edi
pop esi
pop ebx
add esp, 0x130
ret
Function at 0x200061c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x200062cd
mov eax, dword [ebx + 0x3c]
mov ebp, dword [esp + 0x12c]
add eax, ebx
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add esi, ebx
mov dword [esp + 0x1c], eax
test ebp, 0x80000000
jne 0x2000626b
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
add eax, ebx
cmp edx, ecx
mov dword [esp + 0x18], ecx
jbe 0x20006289
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push 0
mov edi, dword [ecx]
add edi, ebx
push edi
call fcn.2000b610
add esp, 4
push eax
push edi
call fcn.20007930
and eax, 0x7fffffff
add esp, 0xc
cmp eax, ebp
je 0x20006256
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jb 0x20006213
jmp 0x20006289
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [edx + eax*2]
mov dx, word [ecx + ebx]
mov word [esp + 0x10], dx
jmp 0x20006289
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov eax, ebp
add edx, ecx
and eax, 0xffff
cmp eax, edx
jae 0x200062cd
cmp eax, ecx
jb 0x200062cd
sub bp, cx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
lea edx, [ecx + eax*4]
mov eax, dword [edx + ebx]
add eax, ebx
je 0x200062cf
cmp eax, esi
jb 0x200062cf
mov ecx, dword [esp + 0x1c]
add ecx, esi
cmp eax, ecx
jae 0x200062cf
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov esi, eax
je 0x200062cd
lea edx, [esp + 0x20]
sub edx, eax
mov al, byte [esi]
inc ecx
mov byte [edx + esi], al
inc esi
cmp al, 0x2e
je 0x200062da
cmp byte [esi], 0
jne 0x200062bd
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
test ecx, ecx
jle 0x200062cd
mov byte [esp + ecx + 0x20], 0x64
inc ecx
mov al, 0x6c
lea edx, [esp + 0x20]
mov byte [esp + ecx + 0x20], al
inc ecx
push edx
mov byte [esp + ecx + 0x24], al
mov byte [esp + ecx + 0x25], 0
call fcn.20007d30
add esp, 4
lea eax, [esp + 0x20]
push eax
call fcn.2000e3c0
push 0
push esi
mov edi, eax
call fcn.2000b610
add esp, 4
push eax
push esi
call fcn.20007930
and eax, 0x7fffffff
push eax
push edi
call fcn.200061c0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x20006340
Capabilities:
Get common file path
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001aaf8
push 0x20019456
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x530
push ebx
push esi
push edi
mov byte [ebp - 0x53c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x53b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], eax
push 0xf003f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov dword [ebp - 0x13c], edi
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, eax
mov dword [ebp - 0x540], esi
test edi, edi
jne 0x200063c5
test esi, esi
je 0x20006430
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x20006430
cmp dword [ebp - 0x134], 1
je 0x200063ff
lea ecx, [ebp - 0x138]
push ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x20006430
push 0x320
call dword [0x2001a280]
push ebx
mov edx, dword [0x20022fe0]
push edx
lea eax, [ebp - 0x53c]
push eax
call dword [0x2001a4dc]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebp - 0x53c]
push ecx
push 0x80000002
call dword [0x2001a408]
mov dword [ebp - 4], 0xffffffff
call fcn.20006459
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x20006470
Capabilities:
Create thread
Get file system object information

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x20]
push esi
xor esi, esi
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push ecx
push edx
call dword [0x2001a08c]
test eax, eax
je 0x200064a0
xor eax, eax
pop esi
add esp, 0x14
ret
push ebp
mov ebp, dword [esp + 0x30]
cmp ebp, esi
push edi
jne 0x20006562
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xd], eax
push 0xa
mov dword [esp + 0x15], eax
push ecx
mov dword [esp + 0x1d], eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
call fcn.2000fed0
add esp, 8
push 1
push 0x200230ac
call fcn.2000e340
push 1
push 0x20023098
call fcn.2000e340
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
push edx
push 0xf003f
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0xc]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push ecx
call edi
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push 8
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov esi, eax
lea ecx, [esp + 0xc]
neg esi
sbb esi, esi
push ecx
inc esi
call dword [0x2001a2dc]
mov eax, dword [esp + 0x2c]
push eax
call edi
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x24]
push ebx
push edx
push 0x20019
push esi
push eax
push ecx
mov dword [esp + 0x48], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [esp + 0x28]
mov ebx, dword [0x2001a07c]
lea edx, [esp + 0x34]
push edx
push esi
push esi
push esi
push ebp
push eax
call ebx
test eax, eax
jne 0x200065f0
mov ecx, dword [esp + 0x34]
add ecx, 2
push ecx
call fcn.20019450
mov ecx, dword [esp + 0x2c]
add esp, 4
lea edx, [esp + 0x34]
mov edi, eax
push edx
lea eax, [esp + 0x30]
push edi
push eax
push 0
push ebp
push ecx
call ebx
test eax, eax
jne 0x200065e7
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push edx
push edi
push eax
push 0
push ebp
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push edi
call fcn.20019410
add esp, 4
mov edx, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push edx
call edi
mov eax, dword [esp + 0x30]
pop ebx
push eax
call edi
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 0x14
ret
Function at 0x20006c80
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push edi
mov edi, dword [esp + 0x30]
push 0xf01ff
push edi
mov dword [esp + 0x10], ecx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, eax
test ebx, ebx
je 0x20006d9e
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push ebx
call dword [sym.imp.USER32.dll_DispatchMessageA]
call dword [0x2001a27c]
cmp eax, 0x7a
jne 0x20006d97
mov eax, dword [esp + 0x30]
push ebp
push esi
push eax
mov ebp, eax
call fcn.20019450
add esp, 4
lea edx, [esp + 0x38]
mov esi, eax
push edx
push ebp
push esi
push ebx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [esi]
mov ebp, dword [0x2001a324]
mov dword [edi + 0x2c4], eax
mov ecx, dword [esi + 4]
mov dword [edi + 0x2c0], ecx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x20006d15
push 0xc7
lea edx, [edi + 0x64]
push eax
push edx
call ebp
add esp, 0xc
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x20006d2b
push 0x1f
push eax
lea eax, [edi + 0x2cc]
push eax
call ebp
add esp, 0xc
mov eax, dword [esi + 0xc]
test eax, eax
je 0x20006d44
push 0x103
lea ecx, [edi + 0x302]
push eax
push ecx
call ebp
add esp, 0xc
mov ecx, dword [esp + 0x10]
push edi
push ebx
call fcn.20015800
push esi
call fcn.20019410
mov eax, dword [esp + 0x40]
add esp, 4
test eax, eax
pop esi
pop ebp
je 0x20006d86
lea edx, [esp + 0xc]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x20006d86
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x2c8], eax
mov dword [edi + 0x2bc], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
pop edi
mov al, 1
pop ebx
add esp, 0x20
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
pop edi
xor al, al
pop ebx
add esp, 0x20
ret 0xc

Function at 0x20007120
Capabilities:
Create thread

Disassembly:
sub esp, 0x3ec
mov eax, dword [esp + 0x3f0]
push esi
lea ecx, [esp + 8]
push eax
push ecx
call dword [0x2001a2b0]
lea edx, [esp + 8]
push 0x5c
push edx
call dword [0x2001a340]
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 4], 0
je 0x2000715b
mov byte [esi], 0
lea eax, [esp + 8]
push eax
call fcn.20006db0
add esp, 4
test esi, esi
je 0x20007188
mov edx, dword [esp + 0x3f8]
lea ecx, [esp + 4]
push ecx
push edx
inc esi
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [esp + 4]
pop esi
add esp, 0x3ec
ret