joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407750
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x24], 0x56dc
mov dword [ebp - 0x28], 0x783e
mov dword [ebp - 0x2c], 0x1557a
mov dword [ebp - 4], 0x4be9
mov dword [ebp - 0x30], 0x1425e
mov dword [ebp - 0x34], 0xd0a3
mov dword [ebp - 0x38], 0xf0f7
mov dword [ebp - 0x3c], 0x4e5a
mov dword [ebp - 0x40], 0x2d60
mov dword [ebp - 0x44], 0x2172
mov dword [ebp - 0xc], 0x10f9c
mov dword [ebp - 0x48], 0xa487
mov dword [ebp - 0x4c], 0x14a10
mov dword [ebp - 0x50], 0x45ae
mov dword [ebp - 0x10], 0xeca5
mov dword [ebp - 0x14], 0xcef3
mov dword [ebp - 0x1c], 0x87be
mov dword [ebp - 0x54], 0x258f
mov dword [ebp - 0x58], 0xd0eb
mov dword [ebp - 0x5c], 0x1f73
mov dword [ebp - 0x20], 0x6ebc
mov dword [ebp - 0x60], 0xe366
mov eax, dword [ebp - 4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x18], 0
je 0x407848
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
jne 0x407848
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0xc]
jne 0x407848
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0xbcfe
push 0x11f80
push 0xd517
push 0x9793
push 0xcb45
push 0x6654
call dword [sym.imp.KERNEL32.dll_MoveFileTransactedA]
add esp, 0x18
mov dword [ebp - 8], 0
jmp 0x40785a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, 0xeca4
cmp dword [ebp - 8], eax
jge 0x407872
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x407851
mov esp, ebp
pop ebp
ret
Function at 0x407f20
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x54], 0x10eab
mov dword [ebp - 0x40], 0x13efc
mov dword [ebp - 0x38], 0x149cf
mov dword [ebp - 0x30], 0x14e8d
mov dword [ebp - 4], 0xc97
mov dword [ebp - 0x44], 0x15dc4
mov dword [ebp - 0x5c], 0x5711
mov dword [ebp - 0x3c], 0x7ee1
mov dword [ebp - 0x50], 0x1926
mov dword [ebp - 0x48], 0xac36
mov dword [ebp - 0x60], 0xa2c6
mov dword [ebp - 0x64], 0xf53c
mov dword [ebp - 0x68], 0xb6f9
mov dword [ebp - 0x20], 0x8966
mov dword [ebp - 0x2c], 0x1ed6
mov dword [ebp - 0x34], 0xb2ad
mov dword [ebp - 0x6c], 0xde9a
mov dword [ebp - 0x70], 0x44d2
mov dword [ebp - 0x58], 0x24f5
mov dword [ebp - 0xc], 0xe937
mov dword [ebp - 0x1c], 0xf936
mov dword [ebp - 0x4c], 0x18192
mov dword [ebp - 0x28], 0x930
mov dword [ebp - 8], 0
jmp 0x407fd9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x1ed5
cmp dword [ebp - 8], ecx
jge 0x407ff2
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x407fd0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x28]
jge 0x408003
mov dword [ebp - 0x14], 1
jmp 0x40800a
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x14]
jge 0x40801b
mov dword [ebp - 0x18], 1
jmp 0x408022
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
or edx, eax
je 0x40810e
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0x1c]
jne 0x40810e
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x20]
jne 0x40810e
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0xc]
jne 0x40810e
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0x18]
jne 0x40810e
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x18]
jne 0x40810e
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x48]
jge 0x408083
mov dword [ebp - 0x24], 1
jmp 0x40808a
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x50]
and ecx, edx
je 0x4080dd
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0xc]
jne 0x4080dd
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x58]
jne 0x4080dd
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x2c]
jne 0x4080dd
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp + 0xc]
jne 0x4080dd
call dword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
je 0x4080dd
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
push 0x1653
push 0xa543
push 0x382d
push 0xa4f6
push 0xeb8b
push 0x46e7
push 0x17ea0
push 0x696b
call dword [sym.imp.KERNEL32.dll_CopyFileTransactedA]
add esp, 0x20
mov dword [ebp - 0x10], 0
jmp 0x408120
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x1c]
sub edx, 0xd5f7
cmp dword [ebp - 0x10], edx
jge 0x408139
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
jmp 0x408117
mov esp, ebp
pop ebp
ret
Function at 0x410ce0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x1c], 0xabde
mov dword [ebp - 0xc], 0x18310
mov dword [ebp - 0x28], 0xa8ac
mov dword [ebp - 0x40], 0x99bc
mov dword [ebp - 0x44], 0x116a6
mov dword [ebp - 0x48], 0x8895
mov dword [ebp - 0x10], 0x169f9
mov dword [ebp - 0x4c], 0x17c28
mov dword [ebp - 0x50], 0x3d7
mov dword [ebp - 0x34], 0x14d45
mov dword [ebp - 0x3c], 0xe872
mov dword [ebp - 0x54], 0x3218
mov dword [ebp - 0x20], 0x109d2
mov dword [ebp - 8], 0x1576a
mov dword [ebp - 0x24], 0x1774b
mov dword [ebp - 0x58], 0x516d
mov dword [ebp - 0x2c], 0x31b0
mov dword [ebp - 0x5c], 0x15d02
mov dword [ebp - 0x30], 0x1491b
mov dword [ebp - 0x38], 0x144c6
mov dword [ebp - 0x60], 0x129e8
mov dword [ebp - 0x64], 0x5590
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
jmp 0x410d9b
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x109d1
cmp dword [ebp - 4], edx
jge 0x410e4c
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 8]
jge 0x410dc7
mov dword [ebp - 0x14], 1
jmp 0x410dce
mov dword [ebp - 0x14], 0
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x28]
jge 0x410ddf
mov dword [ebp - 0x18], 1
jmp 0x410de6
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x2c]
and ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
xor edx, dword [ebp - 0x18]
or ecx, edx
je 0x410e47
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x38]
jne 0x410e47
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x3c]
jne 0x410e47
push 0xacf8
push 0x6dd
push 0x5d1d
push 0xdfca
push 0x155b2
push 0x173fc
push 0x10ccb
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
add esp, 0x1c
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x410d92
mov esp, ebp
pop ebp
ret
Function at 0x411db0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x14], 0x3d9f
mov dword [ebp - 0x18], 0x3a83
mov dword [ebp - 0x3c], 0xabb4
mov dword [ebp - 0x4c], 0xcbb1
mov dword [ebp - 0x10], 0x13ed5
mov dword [ebp - 0x54], 0xe1cc
mov dword [ebp - 0x58], 0xc0ba
mov dword [ebp - 0x2c], 0x903
mov dword [ebp - 0x44], 0x1820e
mov dword [ebp - 0x20], 0x15fe9
mov dword [ebp - 0x5c], 0x6a64
mov dword [ebp - 0x48], 0xced6
mov dword [ebp - 0x1c], 0x81c4
mov dword [ebp - 0x30], 0xa74c
mov dword [ebp - 4], 0x14110
mov dword [ebp - 0x60], 0x143ab
mov dword [ebp - 0x64], 0x15a19
mov dword [ebp - 0x38], 0x6fe7
mov dword [ebp - 0x68], 0x14546
mov dword [ebp - 0x6c], 0x7f70
mov dword [ebp - 0x34], 0xbdaa
mov dword [ebp - 0x40], 0x10f46
mov dword [ebp - 8], 0
jmp 0x411e62
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x902
cmp dword [ebp - 8], ecx
jge 0x411ebf
mov edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x1c]
jge 0x411ebd
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
jne 0x411ebd
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x20]
jne 0x411ebd
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x18]
jne 0x411ebd
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x40]
jne 0x411ebd
push 0xc6c6
push 0xee1b
push 0x7308
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
add esp, 0xc
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x411e59
mov dword [ebp - 0xc], 0
jmp 0x411ed1
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x44]
sub eax, 0x1820d
cmp dword [ebp - 0xc], eax
jge 0x411f3a
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x18]
jge 0x411eef
mov dword [ebp - 0x24], 1
jmp 0x411ef6
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x4c]
jge 0x411f07
mov dword [ebp - 0x28], 1
jmp 0x411f0e
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x50], 0
je 0x411f38
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x411ec8
mov esp, ebp
pop ebp
ret
Function at 0x414970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x44], 0x20a4
mov dword [ebp - 4], 0x155d8
mov dword [ebp - 0x14], 0x14640
mov dword [ebp - 0x3c], 0xcdcb
mov dword [ebp - 0x48], 0x9a6a
mov dword [ebp - 0x28], 0x16bc
mov dword [ebp - 0x4c], 0x2f14
mov dword [ebp - 0x38], 0x7dc1
mov dword [ebp - 0xc], 0x831f
mov dword [ebp - 0x50], 0x14b79
mov dword [ebp - 0x34], 0xdb54
mov dword [ebp - 0x40], 0xca7a
mov dword [ebp - 0x30], 0xfd06
mov dword [ebp - 0x20], 0xcc42
mov dword [ebp - 0x18], 0x54e7
mov dword [ebp - 0x2c], 0x49b8
mov dword [ebp - 0x1c], 0x906a
mov dword [ebp - 0x10], 0xcad2
mov dword [ebp - 0x54], 0x99b6
mov dword [ebp - 8], 0x53c1
mov dword [ebp - 0x58], 0xfd65
mov dword [ebp - 0x5c], 0x144a1
mov dword [ebp - 0x24], 0x73b2
mov eax, dword [ebp - 0xc]
sub eax, 0x6f1
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x10e25
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x8119
push edx
mov eax, dword [ebp - 4]
sub eax, 0x983c
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x837
push ecx
call fcn.00405d90
add esp, 0x14
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x20]
jge 0x414a96
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jne 0x414a96
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jne 0x414a96
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 4]
jne 0x414a96
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x30]
jne 0x414a96
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x34]
jne 0x414a96
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
push 0x47b6
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add esp, 4
mov eax, dword [ebp - 0x38]
add eax, 0x51b7
push eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x35dc
push ecx
mov edx, dword [ebp - 0x40]
add edx, 0xa94e
push edx
mov eax, dword [ebp - 8]
add eax, 0x7fe5
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0xb38b
push ecx
mov edx, dword [ebp - 8]
add edx, 0x3756
push edx
call fcn.00415dc0
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x415280
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x2c], 0x11244
mov dword [ebp - 0x30], 0xeabe
mov dword [ebp - 0x10], 0x12565
mov dword [ebp - 0x34], 0xe011
mov dword [ebp - 0x20], 0x41c8
mov dword [ebp - 8], 0x9f6f
mov dword [ebp - 0x38], 0x17667
mov dword [ebp - 0x3c], 0x11872
mov dword [ebp - 0x40], 0x7ad8
mov dword [ebp - 0x44], 0xd7bd
mov dword [ebp - 0x24], 0x318c
mov dword [ebp - 0x48], 0x838d
mov dword [ebp - 0x4c], 0x13b58
mov dword [ebp - 0x50], 0x4648
mov dword [ebp - 0x28], 0x15c67
mov dword [ebp - 0x54], 0xeb32
mov dword [ebp - 0x58], 0xa79e
mov dword [ebp - 0x5c], 0x5594
mov dword [ebp - 4], 0x1277a
mov dword [ebp - 0x14], 0x41c6
mov dword [ebp - 0x60], 0x6f9e
mov dword [ebp - 0x64], 0xce4b
mov eax, dword [ebp - 0x10]
sub eax, 0x10334
push eax
call fcn.00414f10
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x1c]
jge 0x415357
mov dword [ebp - 0xc], 1
jmp 0x41535e
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x20]
and edx, dword [ebp - 0x24]
and edx, dword [ebp - 0xc]
je 0x4153ae
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0xc]
jne 0x4153ae
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x28]
jne 0x4153ae
push 0x126df
push 0x4124
push 0x16b9
push 0x15d8d
push 0xd811
push 0x5cf2
push 0x9785
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x1c
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov esp, ebp
pop ebp
ret
Function at 0x416840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x44], 0x1543a
mov dword [ebp - 0x48], 0x2489
mov dword [ebp - 0x30], 0xb5dd
mov dword [ebp - 4], 0xd670
mov dword [ebp - 0x10], 0x7af5
mov dword [ebp - 0x34], 0x67b7
mov dword [ebp - 0x3c], 0xa63c
mov dword [ebp - 0x4c], 0x140c5
mov dword [ebp - 0x50], 0xcf84
mov dword [ebp - 0x14], 0x113ae
mov dword [ebp - 0x24], 0x10a3f
mov dword [ebp - 0x20], 0xb8d2
mov dword [ebp - 0x54], 0x12540
mov dword [ebp - 0x58], 0x5f8e
mov dword [ebp - 0x5c], 0x76d
mov dword [ebp - 0x60], 0xa264
mov dword [ebp - 0x40], 0x874d
mov dword [ebp - 0x38], 0x5fc0
mov dword [ebp - 0x64], 0x181c1
mov dword [ebp - 0x68], 0x6740
mov dword [ebp - 0x6c], 0x11b1e
mov dword [ebp - 0x28], 0xc406
mov dword [ebp - 0x2c], 0x6f9e
mov dword [ebp - 0x70], 0x128a9
mov dword [ebp - 8], 0
jmp 0x416900
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0xb5dc
cmp dword [ebp - 8], ecx
jge 0x416984
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jge 0x41691f
mov dword [ebp - 0x18], 1
jmp 0x416926
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x34]
jge 0x416937
mov dword [ebp - 0x1c], 1
jmp 0x41693e
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x18]
and edx, dword [ebp - 0x1c]
or ecx, edx
je 0x41697f
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x14]
jne 0x41697f
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x18]
jne 0x41697f
push 0x13b65
push 0x13c5f
push 0xf8a4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add esp, 0xc
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
jmp 0x4168f7
mov dword [ebp - 0xc], 0
jmp 0x416996
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x40]
sub ecx, 0x874c
cmp dword [ebp - 0xc], ecx
jge 0x4169af
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
jmp 0x41698d
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x9b4e
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x10005
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x1065
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x3c73
push ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x55a5
push edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x87d
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0xa801
push ecx
call fcn.00409240
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x418520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x58], 0x353b
mov dword [ebp - 0x1c], 0x30f9
mov dword [ebp - 0x14], 0x12a61
mov dword [ebp - 0x5c], 0x7086
mov dword [ebp - 0x2c], 0xd4e
mov dword [ebp - 0x68], 0xa74d
mov dword [ebp - 0x6c], 0x13ac1
mov dword [ebp - 0x4c], 0x1d5b
mov dword [ebp - 0x70], 0x10fbf
mov dword [ebp - 0x74], 0x3ed6
mov dword [ebp - 0x64], 0xfc1c
mov dword [ebp - 0x78], 0x752a
mov dword [ebp - 0x48], 0x123f0
mov dword [ebp - 0x10], 0x4897
mov dword [ebp - 0x7c], 0xea27
mov dword [ebp - 0x3c], 0x5c44
mov dword [ebp - 0x54], 0x11a32
mov dword [ebp - 0x50], 0x17b19
mov dword [ebp - 0x38], 0x15f3d
mov dword [ebp - 0x60], 0x4b35
mov dword [ebp - 0x80], 0x106fe
mov dword [ebp - 0x84], 0x1390
mov dword [ebp - 0x18], 0x12f17
mov dword [ebp - 4], 0
jmp 0x4185df
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
sub ecx, 0x9340
cmp dword [ebp - 4], ecx
jge 0x4185f8
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4185d6
mov dword [ebp - 8], 0
jmp 0x41860a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x5c43
cmp dword [ebp - 8], ecx
jge 0x4186c0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 0x14]
add ecx, 1
mov dword [ebp + 0x14], ecx
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x44]
jge 0x418642
mov dword [ebp - 0x20], 1
jmp 0x418649
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0x18]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x48]
jge 0x41865d
mov dword [ebp - 0x24], 1
jmp 0x418664
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x50]
jge 0x418675
mov dword [ebp - 0x28], 1
jmp 0x41867c
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x20]
or edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
and eax, dword [ebp - 0x28]
or edx, eax
je 0x4186bb
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x4186bb
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp + 0x28]
jne 0x4186bb
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x58]
jne 0x4186bb
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp + 0x10]
jne 0x4186bb
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x418601
mov dword [ebp - 0xc], 0
jmp 0x4186d2
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x60]
sub ecx, 0x4b34
cmp dword [ebp - 0xc], ecx
jge 0x41872e
mov edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0x2c]
jge 0x4186f1
mov dword [ebp - 0x30], 1
jmp 0x4186f8
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x68]
or eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jge 0x41870c
mov dword [ebp - 0x34], 1
jmp 0x418713
mov dword [ebp - 0x34], 0
mov ecx, dword [ebp - 0x30]
or ecx, dword [ebp - 0x34]
mov edx, dword [ebp + 0x2c]
xor edx, dword [ebp - 0x38]
or ecx, edx
je 0x41872c
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x4186c9
mov esp, ebp
pop ebp
ret
Function at 0x419190
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 8], 0x100fc
mov dword [ebp - 0x18], 0x9273
mov dword [ebp - 0x3c], 0xf10c
mov dword [ebp - 0x38], 0xd534
mov dword [ebp - 0x2c], 0x91aa
mov dword [ebp - 0x34], 0x17df6
mov dword [ebp - 0x40], 0x79e9
mov dword [ebp - 4], 0x7adc
mov dword [ebp - 0x44], 0xd99f
mov dword [ebp - 0x24], 0x13bfc
mov dword [ebp - 0x1c], 0xc8c1
mov dword [ebp - 0x48], 0x15174
mov dword [ebp - 0x20], 0xc0a5
mov dword [ebp - 0x14], 0xd26e
mov dword [ebp - 0x4c], 0x7bf0
mov dword [ebp - 0x50], 0xd47a
mov dword [ebp - 0x54], 0xc2d3
mov dword [ebp - 0x58], 0x3ba7
mov dword [ebp - 0x5c], 0x14efc
mov dword [ebp - 0x10], 0x1594b
mov dword [ebp - 0x30], 0x3fd8
mov dword [ebp - 0x60], 0x4f10
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jge 0x419241
mov dword [ebp - 0xc], 1
jmp 0x419248
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 8]
or ecx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 0x28], 0
je 0x4192b2
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 4]
jne 0x4192b2
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x30]
jne 0x4192b2
push 0x135f1
push 0xf62
push 0x62ed
push 0x124e2
push 0x7bdb
push 0x92a9
push 0x10cc4
push 0xa9f6
push 0x7b84
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
add esp, 0x24
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
sub eax, 0x63ee
push eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x1d41
push ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x25f4
push edx
mov eax, dword [ebp - 4]
add eax, 0xe674
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x753c
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x9317
push edx
mov eax, dword [ebp - 0x18]
sub eax, 0x731a
push eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0xab41
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0xce
push edx
call fcn.00409970
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x41a000
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x38], 0x12107
mov dword [ebp - 0x3c], 0x1597f
mov dword [ebp - 0x40], 0x156b0
mov dword [ebp - 4], 0x15b49
mov dword [ebp - 0x28], 0x12285
mov dword [ebp - 0x44], 0xc717
mov dword [ebp - 0x48], 0x17af2
mov dword [ebp - 0x14], 0x13b9
mov dword [ebp - 0x20], 0x16bbe
mov dword [ebp - 0x1c], 0x9731
mov dword [ebp - 0x4c], 0x1415f
mov dword [ebp - 0x50], 0x165e7
mov dword [ebp - 0xc], 0x11693
mov dword [ebp - 0x54], 0x80a
mov dword [ebp - 0x58], 0x12bbc
mov dword [ebp - 0x34], 0x1493e
mov dword [ebp - 0x5c], 0x16257
mov dword [ebp - 0x24], 0x141cc
mov dword [ebp - 0x2c], 0xb791
mov dword [ebp - 0x60], 0x2186
mov dword [ebp - 0x18], 0xf160
mov dword [ebp - 0x64], 0xf4c4
mov dword [ebp - 0x10], 0x50ef
mov dword [ebp - 0x30], 0xa43b
mov eax, dword [ebp - 0x14]
add eax, 0x1190
push eax
call fcn.00412bb0
add esp, 4
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x20]
jge 0x41a11d
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jne 0x41a11d
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0xc]
jne 0x41a11d
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x30]
jne 0x41a11d
push 0x2f84
push 0x2993
push 0x692
push 0x92be
push 0xd65d
push 0x56da
push 0x11595
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
add esp, 0x1c
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x4e23
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0xa2cb
push edx
mov eax, dword [ebp - 0x34]
sub eax, 0x3874
push eax
call fcn.0040dd90
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x41a154
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0xf15f
cmp dword [ebp - 8], edx
jge 0x41a16d
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x41a14b
mov esp, ebp
pop ebp
ret