joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14f6b29
Capabilities:
Encode data using xor

Disassembly:
sal ax, 0x81
dec edx
rol ecx, cl
sar ax, 0x8e
or ax, ax
neg edx
not edx
lea ecx, [eax + ecx*2 + 0x2e30839d]
lea eax, [eax + eax*2 + 0x5a862aab]
add al, cl
neg edx
push ecx
bswap edx
inc al
sets cl
add ecx, 0xe6816b3b
xor edx, 0xb782488a
add byte [esp + ecx - 0x77372a39], cl
cwde
not dword [esp + eax - 0x2a29]
xor ebx, edx
bswap ecx
btc eax, ecx
adc edi, edx
lea esi, [esi + eax*2 - 0x1005453]
movzx ecx, byte [esi + eax*2 - 0x1005452]
jmp 0x1084c95
movzx edx, word [esp + eax*4 - 0x200a8a4]
shr edx, 0x8a
xor cl, bl
shr dword [esp + eax - 0x802a29], 0x46
rol cl, 1
jmp 0x10c2cd4
call fcn.00c92ca3
mov eax, 0x3a30a037
mov ecx, eax
lea edx, [ecx + 0x44192dba]
lea esi, [esi + eax - 0x3a30a03b]
add eax, eax
cbw
seto cl
mov edx, dword [eax + esi - 0x7461006e]
shr cl, 0x62
bswap eax
lea ecx, [ecx*8 - 0x59c43bd2]
xor edx, ebx
ror ax, 0xc6
shr eax, 0xc8
neg edx
rol al, 0xa1
jb 0xca5e49

Function at 0x14f6d32
Capabilities:
Encode data using base64
Execute syscall

Disassembly:
btr eax, ecx
inc edx
inc ecx
neg eax
ror edx, 1
xor eax, eax
xor edx, 0xd0877105
bt ax, 0x38
lea edx, [edx + eax + 0x2e2e1bab]
neg edx
call fcn.00c78cb3
mov edx, 0xf7968131
mov ecx, edx
imul cx, dx
mov edx, dword [esi]
inc ecx
mov cl, byte [esi + 4]
adc esi, 1
mov eax, 0xfe3b13a7
shr edx, cl
movsx ecx, al
not ax
mov dword [esi], edx
mov edx, dword [ebp]
bts ax, ax
jae 0x106947b
sal dx, 0x66
adc cl, 0xf
mov dword [esp + eax - 0x52fc0007], eax
sar dword [esp + eax - 0x52fc0007], 0x39
sbb word [esp + eax - 0x52fc0005], ax
neg cl
mul dword [esp + eax - 0x52fc0007]
div dword [esp + eax - 0x4a2b011f]
cdq
ror cl, 1
or dx, dx
xor bl, cl
or byte [esp + edx*2 + 3], 0x36
dec ax
and dl, ah
mov dword [esp + edx], edi
btr edx, 0xa6
sbb eax, 0xee25cb3d
ror edx, 0xff
push esi
call fcn.01318873
mov ecx, 0xe418cd92
movzx edx, cx
movsx eax, dl
movzx eax, byte [esi + edx*2 - 0x19b24]
add cx, dx
btr ecx, edx
rol dx, 0x45
lea esi, [esi + edx*4 - 0x2c963]
and cl, dh
sar cx, 0x42
dec ecx
xor al, bl
rol al, 1
inc al
call fcn.01348e91
mov edx, dword [esi]
mov ecx, 0x800b1908
movsx eax, cx
lea esi, [esi + eax*4 - 0x641c]
bt cx, 7
not cl
xor edx, ebx
xchg ecx, eax
shr ecx, 0x61
setno al
inc edx
and ax, cx
add cx, ax
sub ecx, eax
bswap edx
bt eax, ecx
sbb ecx, eax
xadd cx, ax
not edx
shl cx, 0xcc
xor cl, 0xb0
shr al, 0x45
bswap edx
btr eax, ecx
jb 0xc76880
neg eax
and ecx, ecx
push ecx
lea eax, [ecx + eax + 0x3b08c03a]
adc byte [esp + ecx*8 - 0x61ee5], 0x1a
mov edx, dword [esp + 4]
adc edx, 0xfff15133
jmp edx

Function at 0x14fe58c
Capabilities:
Execute syscall

Disassembly:
call fcn.014b7ee7
dec ecx
sub edi, 4
inc ecx
mov ebx, 0xdbf8134
call fcn.012e08de
xor byte [esp + 2], 0xb2
inc eax
ror word [esp + 2], 0xe2
bt dx, 0x97
xor ebx, ecx
and eax, 0x7e9a9f05
shr al, 0x47
ror dl, 4
adc esi, ecx
mov dx, word [eax + ebp - 0x6c809200]
mov ax, word [ebp + eax - 0x6c8091fe]
pop ecx
mov ecx, dword [esp]
inc dword [esp + ecx*2 - 0x6721760c]
mov cl, byte [ebp + ecx - 0x3390bb02]
add ebp, 4
jmp 0x14f8a9c
Function at 0x150c277
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
mov dword [esp + edx - 0x859b0aa], edx
and dx, dx
not ecx
xor ecx, 0x172a180a
rol dx, 0xa6
bswap ecx
mov dword [esp + edx - 0x8592bac], edx
adc dl, dl
ror ecx, 1
bswap edx
lea eax, [edx*2 + 0x729db32e]
pop edx
bswap ecx
push eax
call fcn.0106a4bd

Function at 0x152612c
Capabilities:
Encode data using xor

Disassembly:
lea eax, [esp + eax + 4]
call fcn.01584044
dec al
btr edx, 0x9f
xor bl, al
jmp 0x10743af
movzx eax, byte [edi]
push 0xffa34890
add edi, 1
xor al, bl
pop ecx
dec al
mov dword [esp + ecx + 0x5cb770], ecx
xor al, 0x39
ror ecx, cl
and dword [esp], ecx
btr ecx, 0x9f
neg al
movzx edx, cl
lea edx, [edx + ecx*8 + 0x3b8a29a9]
not al
jmp 0x111f707

Function at 0x153ce40
Capabilities:
Encode data using xor

Disassembly:
neg edx
rol edx, 3
ror byte [esp + ecx - 0x1d191], 0xe2
call fcn.010f3316
movzx ax, byte ss:[edx + ecx - 0x8c]
lea edi, [edi + ecx*2 - 0x116]
movsx edx, cx
neg edx
add cx, 0xb4b9
mov word [ecx + edi - 0xb545], ax
add ecx, 0xdd8ea116
add cx, dx
jbe 0x1130296
sub ebp, 4
mov eax, 0x51268a8d
cbw
mov ecx, dword [ebp + eax - 0x5126ff8d]
cbw
movsx edx, ax
xor ecx, ebx
cdq
xadd al, ah
adc ecx, edx
div eax
neg ax
xor ecx, 0x61b5d6ba
or dx, dx
not eax
inc ecx
cwde
neg ecx
call fcn.0106cea8
lea edx, [esp + edx + 0xc]
shr byte [esp + eax + 2], 0x24
ror byte [esp + eax*8], 1
mov byte [edx + eax*8], cl
call fcn.01492543
jmp ebp
shr ecx, cl
lea edx, [edx + ecx - 0x1c3a3cd4]
jnp 0xc76b63
and dx, ax
mov dword [esp], ecx
and dword [esp], ecx
sbb cl, cl
not dx
xadd dword [esp], ecx
mov word [edi], dx
sbb ebp, 3
sar word [esp], 0x63
xchg byte [esp + 1], ch
mov edx, dword [ebp]
push ecx
movzx eax, cl
neg cx
xor edx, ebx
shl dword [esp + eax - 0xef], 0x25
jb 0x14a0e6e

Function at 0x155def4
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 8], ecx
xor ebx, edx
or byte [esp + 5], 0x9f
adc esi, edx
call fcn.01034dc4

Function at 0x155efc6
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
not ecx
ror ecx, 3
inc ecx
neg ecx
rol ecx, 2
xor dx, dx
sbb dl, dh
bswap ecx
rol al, 0xe2
mov dword [esp + eax - 0x1900], edx
dec edx
dec ecx
neg byte [esp + eax*8 - 0xc7ff]
xor ecx, 0x2be319e
and dl, 0x94
ja 0x147ecd1

Function at 0x15726e5
Capabilities:
Encode data using xor

Disassembly:
pop eax
pop edx
pop edx
pop ecx
jb fcn.01507e07
sub ch, dl
sub al, byte [edi + 0x7cfa7cb8]
xor esi, dword [edx + edi*2 + 0x16250b6f]
scasd eax, dword es:[edi]
mov ebx, 0x5811d1f
invalid
ror al, 1
dec al
lea edx, [edx*4 - 0x6b7a54f9]
rol al, 1
lea ecx, [edx + edx - 0x4444cff0]
inc al
add dword [esp + ecx*2 - 0x245b8842], ecx
not edx
jbe 0x133a0cb
xor al, 0xad
call fcn.0101d8e3
Function at 0x1574114
Capabilities:
Encode data using base64

Disassembly:
adc ebp, edx
lea edx, [eax*4 - 0x5ee4cd3]
imul cx, ax
pop eax
mov eax, edi
xchg word [esp + ecx*2 + 5], cx
setae cl
lea edi, [ecx + edi - 0x9203]
xchg dword [esp + ecx - 0x9200], edx
cmovae ecx, edx
xchg dword [esp + ecx*2 - 0x47fffffc], ecx
mov word [edi + edx - 0x24000000], ax
neg edx
not ecx
pop edx
pop eax
js fcn.012f3110
mov ecx, 0xc398a32f
movsx edx, cl
lea ebp, [ebp + edx - 0x33]
and cl, ch
movsx eax, dx
inc ecx
mov ecx, dword [ebp + edx - 0x2f]
xor ecx, ebx
sub ecx, 0x9a2efa2a
shl edx, 0x45
ror ecx, 3
bswap ecx
imul dx
rol al, 0xe4
adc ecx, edx
bt eax, edx
shl al, 0xc1
neg ecx
ror ecx, 2
push eax
bswap ecx
neg ecx
neg dword [esp + edx*4 - 4]
rol ecx, 1
bt dx, 0x8b
shr byte [esp + edx*8 - 8], 0x44
xor ebx, ecx
dec ax
lea edx, [eax + eax*2 + 0x15045134]
add edi, ecx
mul dx
call fcn.01387afc

Function at 0x157f4f6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xe8a6fc26
call fcn.013854f5

Function at 0x157f503
Capabilities:
Encode data using base64
Encode data using xor
Execute syscall

Disassembly:
adc ebp, 5
shr dx, 0xcb
add dl, byte [esp + 0xc]
call fcn.010cd7d3
dec esp
mov esi, dword [esp + eax - 0x40000059]
dec ebp
arpl bx, bx
dec ecx
add edi, ebx
cwde
pop edx
pop eax
jmp fcn.0148e47d

Function at 0x1596c51
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xead48be
not dl
xchg byte [esp + ecx - 0x7a16be2d], dl
push edx
xor ebx, eax
push ecx
inc dx
add esi, eax
neg dword [esp + edx + 6]
mov eax, dword [ebp + ecx - 0x7a16be30]
ror byte [esp + edx + 6], 0xa4
imul ecx, ecx
mov ecx, dword [ebp + edx + 3]
mov dword [esp + edx*4 + 4], ebx
mov ebx, dword [esp + edx + 2]
push ebx
cpuid
sbb ebp, 7
sal word [esp], 3
inc word [esp + 6]
inc word [esp + 7]
mov dword [ebp + 0xc], eax
push 0xe07a4a0
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
mov dword [ebp], edx
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
bts ax, 3
xchg dword [esp + eax*2 - 9], eax
pop ecx
pop edx
pop edx
pop edx
pop eax
jae 0x112164c
inc eax
rol eax, 3
xadd dl, cl
mov dword [esp + edx - 0x78db40da], edx
shr dword [esp + edx - 0x78db40da], cl
inc eax
sar edx, 0xfc
xor dl, byte [esp + edx - 4]
jae 0x10fd238
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x409070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40907f
pop dword [ebp - 0x18]
mov eax, 0xab5c8d42
sub eax, 0xab1bfcc3
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x36b32
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x4bcad1d9
sub ecx, 0x4bca93dd
mov esi, eax
mov edi, 0x5f4b4091
add edi, 0xa0f5fb33
add edi, dword [ebp - 0x18]
mov edx, 0xf45a1e74
mov dword [ebp - 0xc], 0x14f96dec
mov ebx, dword [edi]
xor dword [ebp - 0x10], 0x9c4dcaed
sub ebx, edx
sub dword [ebp - 4], 0xd1900430
mov dword [esi], ebx
add dword [ebp - 4], eax
add esi, 0x93393483
add esi, 0x6cc6cb81
add edi, 0x4aa9665d
add edi, 0xb55699a7
loop 0x4090d3
add eax, 0xeac3
xor ebx, ebx
add ebx, eax
add eax, 0xd7e4c226
add eax, 0x281b3ddf
mov ecx, 0x13a99d7a
sub ecx, 0x13699d7a
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4068c0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4068df
cmp eax, 0x106
je 0x4068df
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x406902
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x4068f8
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x406a10
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42ed58
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call ebp
test eax, eax
je 0x406a5b
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
push 4
lea esi, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.00404e70
mov eax, esi
push eax
push ebx
mov dword [esp + 0x2c], 0
call fcn.004081c0
test al, al
je 0x406ac8
cmp dword [esp + 0x14], 0
setne al
test al, al
je 0x406ac8
mov esi, dword [esp + 0x10]
push edi
push esi
call ebp
test eax, eax
push esi
setne bl
mov dword [esp + 0x28], 0xffffffff
call fcn.00421d8e
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00421d8e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x406b00
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x430758
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebp
call edi
test eax, eax
je 0x406b3c
mov al, 1
jmp 0x406ba9
xor ebx, ebx
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.004081c0
test al, al
je 0x406b92
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406b92
mov esi, dword [esp + 0x14]
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421d8e
add esp, 4
mov al, bl
jmp 0x406ba9
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00421d8e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x406bc0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x430758
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
push ebx
push ebp
call edi
test eax, eax
je 0x406bff
mov al, 1
jmp 0x406c78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406c76
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.004081c0
test al, al
je 0x406c61
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406c61
mov esi, dword [esp + 0x14]
push ebx
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421d8e
add esp, 4
mov al, bl
jmp 0x406c78
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00421d8e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x4070d0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x430758
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call ebx
test eax, eax
jne 0x407181
mov eax, ebp
call fcn.00407070
cmp eax, 1
jne 0x407125
xor edi, edi
mov ecx, ebp
call fcn.00406a10
test al, al
je 0x4071f8
push ebp
call ebx
test eax, eax
jne 0x407181
xor edi, edi
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], edi
call fcn.004081c0
test al, al
je 0x4071e3
cmp dword [esp + 0x18], edi
setne al
test al, al
je 0x4071e3
mov esi, dword [esp + 0x14]
push esi
call ebx
test eax, eax
je 0x407185
push esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421d8e
add esp, 4
mov al, 1
jmp 0x4071fa
mov eax, esi
call fcn.00407070
cmp eax, 1
jne 0x4071ab
xor edi, edi
mov ecx, esi
call fcn.00406a10
test al, al
jne 0x4071a9
mov dword [esp + 0x28], 0xffffffff
push esi
jmp 0x4071f0
xor edi, edi
push esi
call ebx
push esi
test eax, eax
je 0x4071c7
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421d8e
add esp, 4
mov al, 1
jmp 0x4071fa
call ebx
cmp eax, edi
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421d8e
add esp, 4
mov al, bl
jmp 0x4071fa
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00421d8e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x4078e0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4078ff
cmp eax, 0x106
je 0x4078ff
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x407922
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x407918
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x407940
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
jg 0x40795e
cmp eax, 0x106
je 0x40795e
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esi]
xor eax, eax
cmp word [edx], ax
je 0x40798a
mov ecx, edx
lea ebx, [ebx]
add ecx, 2
inc eax
cmp word [ecx], 0
jne 0x407980
xor ecx, ecx
mov word [edx + eax*2], cx
mov dword [esi + 4], eax
mov al, 1
pop esi
ret
Function at 0x4079a0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4079bf
cmp eax, 0x106
je 0x4079bf
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push 0
push 0x434980
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x4079ea
mov edx, edi
nop
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x4079e0
xor edx, edx
mov word [edi + ecx*2], dx
pop edi
mov dword [esi + 4], ecx
pop esi
ret 4

Function at 0x4081c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42fd70
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
movzx eax, word [ebp]
xor edi, edi
cmp ax, cx
je 0x40820e
inc edi
cmp word [ebp + edi*2], cx
jne 0x408206
cmp edi, 1
movzx ebx, ax
jl 0x408379
cmp bx, 0x5c
je 0x408379
cmp bx, 0x2e
jne 0x408242
cmp edi, 1
je 0x408379
cmp edi, 2
jne 0x408242
cmp word [ebp + 2], bx
je 0x408379
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call fcn.00404e70
cmp edi, 3
mov dword [esp + 0x4c], 0
jle 0x408289
cmp word [ebp + 2], 0x3a
jne 0x408289
cmp word [ebp + 4], 0x5c
jne 0x408289
cmp bx, 0x61
jb 0x408280
cmp bx, 0x7a
jbe 0x4082f1
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x4082f1
mov eax, dword [esp + 0x1c]
cmp eax, 0x105
jg 0x4082a9
cmp eax, 0x106
je 0x4082a9
push 0x106
lea esi, [esp + 0x18]
call fcn.00404e70
mov eax, dword [esp + 0x14]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [esp + 0x14]
mov edi, eax
call fcn.00406200
test edi, edi
je 0x408391
cmp edi, 0x104
ja 0x408391
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x4082f1
push 0x5c
mov eax, esi
call fcn.00404c40
mov ebx, str.__
lea eax, [esp + 0x38]
call fcn.00404b30
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
mov edi, eax
mov byte [esp + 0x54], 1
call fcn.00407ca0
push ebp
lea ecx, [esp + 0x24]
mov bl, 2
push ecx
mov edi, eax
mov byte [esp + 0x54], bl
call fcn.00408600
mov edi, eax
mov eax, dword [esp + 0x58]
mov byte [esp + 0x4c], 3
call fcn.00404bf0
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0x20]
push edx
call fcn.00421d8e
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x30]
push eax
call fcn.00421d8e
mov byte [esp + 0x54], 0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00421d8e
mov dword [esp + 0x58], 0xffffffff
mov edx, dword [esp + 0x20]
push edx
call fcn.00421d8e
add esp, 0x10
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 8
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
call fcn.00421d8e
add esp, 4
xor al, al
jmp 0x40837b
Function at 0x4139d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f7e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.00413850
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
test eax, eax
je 0x413a39
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x418e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42ffe9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
call fcn.00418c90
lea edx, [esp + 0xc]
mov dword [esp + 0x20], 0
push edx
mov dword [esp + 0xc], 1
call fcn.00405080
push ebx
mov ecx, eax
call fcn.00404fe0
mov eax, dword [esp + 0xc]
push eax
call fcn.00421d8e
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x419c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
xor ecx, ecx
mov word [esp + 0xc], ax
mov word [esp + 0xe], cx
mov dword [esp + 0x28], eax
mov byte [ebx], al
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], eax
mov eax, dword [ebp]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 0xc
push ecx
push eax
call edx
mov edi, eax
test edi, edi
je 0x419c9e
lea ecx, [esp + 0xc]
call fcn.00408890
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
mov ax, word [esp + 0xc]
cmp ax, 0x40
jne 0x419cb8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x419cf0
test ax, ax
je 0x419cdf
lea ecx, [esp + 0xc]
call fcn.00408890
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
cmp byte [ebp + 0x2c], 0
je 0x419cf3
mov edx, dword [ebp + 0x24]
mov dword [esi], edx
mov eax, dword [ebp + 0x28]
mov dword [esi + 4], eax
mov byte [ebx], 1
lea ecx, [esp + 0xc]
call fcn.00408890
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8