joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473420
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a1c90
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4735c7
mov ecx, dword [0x52eed8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x47351c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00472140
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004927b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.004926c3
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x52c004
call fcn.00492731
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00472500
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004927b0
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004926c3
lea ecx, [esp + 0xc]
call fcn.00492b8b
mov ecx, dword [esp + 0xc]
push 0x52ca44
push ecx
call fcn.00482264
add esp, 8
test eax, eax
je 0x473544
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x47347d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.004926c3
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004926c3
jmp 0x4735cb
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.004731c0
test eax, eax
push 0
je 0x4735af
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.00471860
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x473595
cmp eax, 0x64
jg 0x473583
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x473520
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x473520
cmp eax, 0x64
jge 0x47351c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x473520
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.00471860
mov esi, eax
jmp 0x473520
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x4735d5
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x47ba40
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x52d324]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x47ba53
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x47ba94
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x52d3cc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x47bac6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x47baca
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x47babb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x47bae8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x47baec
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x47badd
xor ecx, ecx
mov eax, 0x52d334
xor ebx, ebx
mov bl, byte [ecx + 0x52d3dc]
cmp byte [esp + ebx + 0x14], 0
je 0x47bb17
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x52d3f4]
cmp byte [esp + ebx + 0x14], 0
je 0x47bb2e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x47bafe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x47ba87
lea edx, [esp + 0x84]
push edx
call fcn.0047bb70
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x47e760
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x47e803
test eax, eax
jbe 0x47e803
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x47e803
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x47e7ae
xor esi, esi
jmp 0x47e7b4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x47e7df
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00467e10
add esi, eax
push esi
mov ebx, esi
call fcn.00467e10
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x47e7c0
pop ebp
test edi, edi
pop edi
jne 0x47e803
test ebx, ebx
je 0x47e803
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00482ba0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x47e945
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x47ea5d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47ea5d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00494103
mov esi, eax
test esi, esi
je 0x47ea5d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x47ea5d
mov ecx, esi
call fcn.0047e8b0
cmp edi, eax
jge 0x47ea5d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x47e9e3
mov dword [esp + 0x34], 1
jmp 0x47ea3e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x47ea5d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0047de70
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x494aa7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x494adf
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00492b1e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00492af6
jmp 0x494aeb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x496199
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4961db
call fcn.0049bf18
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4961db
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4961d2
xor eax, eax
jmp 0x4961e3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004961e9
pop edi
pop esi
pop ebx
ret 4

Function at 0x49c448
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49c476
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49c494
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049c3ae
jmp 0x49c494
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49c494
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049c3ae
test edi, edi
mov eax, edi
jne 0x49c47e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403510
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [0x40903c]
test eax, eax
jne 0x4035c0
mov edx, dword [esp + 8]
mov esi, dword [section..rdata]
push 0x2b
push str.Realtek_HD_Front_Pink_Jack
push 1
push edi
push str.Record
push edx
call esi
mov eax, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push edi
push str.PreferredOnly
push edx
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 2
call fcn.00403750
mov eax, dword [esp + 8]
push eax
call dword [0x409008]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x4035d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [0x40903c]
test eax, eax
jne 0x403680
mov edx, dword [esp + 8]
mov esi, dword [section..rdata]
push 0x2b
push str.Back_Line_in_Mic
push 1
push edi
push str.Record
push edx
call esi
mov eax, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push edi
push str.PreferredOnly
push edx
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 2
call fcn.00403750
mov eax, dword [esp + 8]
push eax
call dword [0x409008]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret
Function at 0x403690
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [0x40903c]
test eax, eax
jne 0x403740
mov edx, dword [esp + 8]
mov esi, dword [section..rdata]
push 0x2b
push str.Realtek_HD_Audio_Rear_Input
push 1
push edi
push str.Record
push edx
call esi
mov eax, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push edi
push str.PreferredOnly
push edx
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 2
call fcn.00403750
mov eax, dword [esp + 8]
push eax
call dword [0x409008]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x403750
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x88
push esi
push edi
mov ecx, 0x12
mov esi, str.SYSTEMCurrentControlSetControlMediaResourcesSetupPreferredAudioDevices
lea edi, [esp + 0x44]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x18]
push eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x48]
mov edi, 4
push ecx
push 0x80000002
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edi
call dword [0x40900c]
test eax, eax
jne 0x403821
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.SetupPreferredAudioDevicesCount
push edx
call dword [0x409004]
mov eax, dword [esp + 8]
mov esi, dword [0x409008]
push eax
call esi
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x80000001
call dword [0x40903c]
test eax, eax
jne 0x403821
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push edi
push eax
push edi
push 0
push str.SetupPreferredAudioDevicesCount
push ecx
call dword [section..rdata]
mov edx, dword [esp + 8]
push edx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x88
ret
pop edi
xor eax, eax
pop esi
add esp, 0x88
ret
Function at 0x403830
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [0x40903c]
test eax, eax
jne 0x4038e0
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 8]
mov esi, dword [section..rdata]
push 0x2b
push edx
push 1
push edi
push str.Record
push eax
call esi
mov ecx, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push edi
push str.PreferredOnly
push eax
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 0x100
call fcn.00403750
mov ecx, dword [esp + 8]
push ecx
call dword [0x409008]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x4038f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [0x40903c]
test eax, eax
jne 0x4039a0
mov edx, dword [esp + 8]
mov esi, dword [section..rdata]
push 0x2b
push str.Realtek_HD_Front_Pink_Jack
push 1
push edi
push str.Record
push edx
call esi
mov eax, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push edi
push str.PreferredOnly
push edx
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 0x100
call fcn.00403750
mov eax, dword [esp + 8]
push eax
call dword [0x409008]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x403c50
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov esi, 1
call dword [0x409028]
test eax, eax
je 0x403c7c
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 4]
push edi
mov edi, dword [0x409018]
push str.SoundMan
push ecx
call edi
test eax, eax
je 0x403c95
xor esi, esi
mov edx, dword [esp + 8]
push str.AlcWzrd
push edx
call edi
test eax, eax
pop edi
je 0x403ca8
xor esi, esi
mov eax, dword [esp + 4]
push eax
call dword [0x409008]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x40782a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x407858
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x40785f
cmp ebx, dword [eax + 4]
jae 0x40785f
xor eax, eax
jmp 0x407a4f
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x407870
xor eax, eax
inc eax
jmp 0x407a4e
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x407886
cmp ecx, edx
jae 0x4079cb
cmp dword [eax + 4], 0
je 0x40788f
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x407877
cmp dword [ebp + 8], 0
je 0x4078b1
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4079cb
cmp eax, esi
jae 0x4079cb
mov eax, dword [0x40f2e0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4078d6
cmp dword [esi*4 + 0x40f2e8], edi
je 0x4079cf
inc esi
cmp esi, eax
jl 0x4078c4
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4090d0]
test eax, eax
je 0x407a4b
cmp dword [ebp - 8], 0x1000000
jne 0x407a4b
test byte [ebp - 0xc], 0xcc
je 0x407954
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x407a4b
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407a4b
cmp word [eax + 0x18], 0x10b
jne 0x407a4b
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x407a4b
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x407954
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x407954
test byte [ecx + 0x27], 0x80
jne 0x4079cb
push 1
push 0x40f328
call dword [0x40910c]
test eax, eax
jne 0x407868
mov ecx, dword [0x40f2e0]
test ecx, ecx
mov edx, ecx
jle 0x407988
lea eax, [ecx*4 + 0x40f2e4]
cmp dword [eax], edi
je 0x407988
dec edx
sub eax, 4
test edx, edx
jg 0x40797c
test edx, edx
jne 0x4079b9
push 0xf
pop ebx
cmp ecx, ebx
jg 0x407995
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4079ad
lea eax, [edx*4 + 0x40f2e8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40799b
cmp ecx, 0x10
jge 0x4079b9
inc ecx
mov dword [0x40f2e0], ecx
push 0
push 0x40f328
call dword [0x40910c]
jmp 0x407868
xor eax, eax
jmp 0x407a4e
test esi, esi
jle 0x407868
mov ebx, dword [0x40910c]
push 1
push 0x40f328
call ebx
test eax, eax
jne 0x407868
cmp dword [esi*4 + 0x40f2e8], edi
je 0x407a25
mov eax, dword [0x40f2e0]
lea esi, [eax - 1]
test esi, esi
jl 0x407a13
cmp dword [esi*4 + 0x40f2e8], edi
je 0x407a0f
dec esi
jns 0x407a03
test esi, esi
jge 0x407a23
cmp eax, 0x10
jge 0x407a1e
inc eax
mov dword [0x40f2e0], eax
lea esi, [eax - 1]
jmp 0x407a25
je 0x407a3d
xor ecx, ecx
test esi, esi
jl 0x407a3d
lea eax, [ecx*4 + 0x40f2e8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x407a2b
push 0
push 0x40f328
call ebx
jmp 0x407868
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4097d6
Capabilities:
Encode data using xor

Disassembly:
sbb dword [0x61bfc9ca], esp
pop ebp
sbb ch, byte [edx]
wait
stc
hlt
or edi, dword [esi - 9]
js 0x4097a4
push es
nop
xchg esp, eax
aas
arpl word [ebx], cx
sahf
inc ecx
jge 0x40978b
pushal
mov ah, 0xfe
adc dword [edx], esi
and dword [eax + ebx*2], edx
adc al, 0x58
inc ebp
adc eax, 0x2b78a6b9
lea eax, [esi + 0x4cbc5d39]
mov eax, dword [ecx + ebx*8 - 0x19db04e3]
jg 0x40976a
stosd dword es:[edi], eax
jns 0x4097ab
push es
jns 0x40980e
daa
mov al, byte [0xf8ed5de7]
in eax, dx
clc
std
push ebp
invalid
or al, 0x81
dec esp
mov dl, 0xad
cmpsb byte [esi], byte es:[edi]
mov ebx, 0xac3452c7
js 0x409776
cmp bl, byte [ebp + 0x3a4f1efc]
cmp dword [ebx - 0x3ac0c785], ecx
cmc
inc esp
push 0x6db40af4
test ebx, edi
xchg dword [edx], ecx
mov al, 0xd8
inc edx
invalid
or bl, byte [ebx - 0x733bd50b]
jmp 0x40983d
push ebp
inc ecx
add al, 0x55
lodsd eax, dword [esi]
dec edi
lahf
jbe 0x4098c1
insb byte es:[edi], dx
pop ds
insb byte es:[edi], dx
pop ss
sub esp, eax
cdq
inc ebx
test byte cs:[esi + 0x291d19b9], 0x76
pop ss
cmp byte [edx - 0x79], al
jns 0x4098a2
sti
pop ebp
lds ecx, [eax + 0x58]
pop edi
pop esp
push es
out dx, al
js 0x40986e
out 0x3b, al
sbb byte [edx], al
ja 0x409867
pop esp
outsb dx, byte [esi]
mov bh, 0x7c
mov edi, 0x3801c629
add dword [eax], edi
jbe 0x4098f1
invalid
cmc
in al, 0x8b
or dh, ch
mov esi, 0xf82f975
add byte [esi + edx*8], bh
enter 0xffffffffffff8b18, 0x1a
push 0xffffffffffffffd9
cmp edi, dword [edx]
jns 0x409891
sbb byte [edx], cl
sbb byte [edx + 9], dh
fdivr dword [edx + ecx + 0x58]
dec eax
mov dh, 0xba
mov eax, dword [0xd1fdeac2]
sbb byte [esi + 0x40fdfcfb], al
sahf
add word [ecx], bx
add dword [ecx], ebx
jno 0x40993f
lahf
stc
imul esi, dword [edi - 0x5afd521a], 0x1b
cmp eax, 0xdaf005f1
ja 0x409875
clc
cli
sal byte [ecx + edx*4 - 0x30], 0x4e
iretd
mov eax, 0xd445b1e0
test eax, 0x9101efe4
mov eax, 0x326b4989
sar byte [ebx - 0x2067c58f], cl
mov cl, 0x45
aam 0xa9
in al, 0xef
add dword [ecx + 0x6b4989b8], edx
xor dl, dl
mov ebx, 0xdf983a71
stosb byte es:[edi], al
sub bl, ah
pop ebx
or ebp, dword [ebp + 0x1eb30296]
adc al, byte [ebp + 0x7d]
xchg ecx, eax
invalid
cli
salc
or al, byte [ebp - 0x4f67aa26]
mov dl, cl
push ds
sub cl, bh
lea edx, [ecx + 0x214d2b8a]
fld dword [ebx + ebx*8 + 0x4f]
jecxz 0x409937
pushfd
lodsd eax, dword [esi]
in al, dx
cli
adc byte [ebx - 0x6dde5cef], ch
push esp
or esi, ecx
loopne 0x40999c
sal byte [edi + 0x84bc2ee], 1
jnp 0x4098ef
arpl word [edi], si
or al, 0x64
push ds
sbb dword [ebp - 0x14], eax
int1
sub byte [eax + 0x6da028c4], cl
stc
test byte [edi], dl
ror dword [edi + esi*2 + 0x6b60d97], 1
dec esi
mov cl, 0x1e
sub byte [ebp - 0x6f], dh
retf 0x1b2b
sar byte [ebp - 0x5a], 0xa8
dec ebp
or byte [ecx], bh
sub dl, cl
mov bh, 0xaf
invalid
Function at 0x44a880
Capabilities:
Get common file path

Disassembly:
sub esp, 0x478
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 0x240]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x240]
push eax
call fcn.0044a810
add esp, 4
lea ecx, [esp + 4]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0x104
pop edi
jbe 0x44a8c1
xor eax, eax
mov edx, dword [esp + 0x47c]
lea eax, [esp + eax*2]
push edx
push str._s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp]
push 8
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x478
ret 4