joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102e9020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], ebx
push edi
test esi, esi
je 0x102e91c0
test ebx, ebx
je 0x102e904d
cmp dword [ebx + 0x1f0], 0
jne 0x102e905c
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x102e91c0
mov edi, dword [esi + 8]
mov dword [esp + 0x14], edi
test edi, edi
je 0x102e9162
jmp 0x102e9070
mov eax, dword [edi + 0x14]
mov dword [esp + 0x2c], eax
test ebx, ebx
je 0x102e9088
cmp dword [ebx + 0x1f0], 0
jne 0x102e9139
mov esi, dword [edi]
mov ecx, esi
mov dword [esp + 0x20], esi
test esi, esi
je 0x102e90ae
cmp byte [esi], 0
je 0x102e90a6
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x102e90a0
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [edi + 0x18]
add eax, 0x18
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov edx, dword [eax]
mov dword [esp + 0x24], edx
test edx, edx
je 0x102e910f
xor edi, edi
mov dword [esp + 0x1c], esi
mov ebx, ecx
test ecx, ecx
jle 0x102e90f9
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x103fe900]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x102e90d4
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
mov eax, edi
mov edi, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x24]
mov eax, dword [esp + 0x10]
jmp 0x102e9111
xor edx, edx
push edx
mov dword [esp + 0x10], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.102b78a0
add esp, 8
test eax, eax
je 0x102e9139
push dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, eax
call fcn.102b7950
add esp, 4
mov edx, dword [edi + 0x10]
mov ecx, ebx
call fcn.102b42e0
mov edx, edi
mov ecx, ebx
call fcn.102b42e0
mov eax, dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x102e9070
mov esi, dword [esp + 0x18]
mov edx, esi
mov ecx, ebx
call fcn.102f45c0
mov edx, esi
mov ecx, ebx
call fcn.102e8fa0
mov edx, dword [esi]
mov ecx, ebx
call fcn.102b42e0
mov edx, dword [esi + 0x14]
mov ecx, ebx
call fcn.102b42e0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x102e91a0
mov edx, esi
mov ecx, ebx
call fcn.102fc9d0
mov edx, esi
mov ecx, ebx
call fcn.102b42e0
mov esi, dword [esp + 0x18]
mov ecx, ebx
mov edx, dword [esi + 0x18]
call fcn.102e13e0
mov edx, esi
mov ecx, ebx
call fcn.103095d0
mov edx, esi
mov ecx, ebx
call fcn.102b42e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102eadb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x104d9790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push 0x1041f560
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.102b5aa0
mov ecx, dword [ebx]
lea edx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
je 0x102eae26
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x102eae20
lea eax, [ebp - 0x1c]
xor ebx, ebx
sub edx, eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x102eaf61
mov edi, ebx
cmp ebx, 2
jge 0x102eae51
xor edi, 1
test esi, esi
je 0x102eaeaf
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x102eae8d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x103fe900]
cmp cl, byte [edx + 0x103fe900]
jne 0x102eae8d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x102eae70
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x103fe900]
movzx ecx, byte [ecx + 0x103fe900]
sub eax, ecx
jne 0x102eaf23
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x102eaefb
xor esi, esi
lea ebx, [ebp - 0x1c]
mov edi, edx
test edx, edx
jle 0x102eaef0
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x103fe900]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x102eaed0
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x102eaefd
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.102b78a0
add esp, 8
test eax, eax
je 0x102eaf1c
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x102eaf40
jmp 0x102eaf26
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x102eaf26
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
inc ebx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x102eae47
test eax, eax
je 0x102eaf61
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
push eax
push esi
push 0x1041efc0
push ebx
call fcn.102e8880
add esp, 0x18
jmp 0x102eaf64
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 3
jle 0x102eadf0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.103362c6
mov esp, ebp
pop ebp
ret
Function at 0x102ed890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, edx
xor edx, edx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x20], eax
mov esi, dword [eax]
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edx
lea ecx, [ecx]
mov al, byte [edx + 0x103feee4]
mov byte [ebp - 1], al
test esi, esi
je 0x102ed953
cmp byte [esi], 0
mov ecx, esi
je 0x102ed8ce
inc ecx
cmp byte [ecx], 0
jne 0x102ed8c8
sub ecx, esi
lea eax, [ebx + 0x19c]
and ecx, 0x3fffffff
mov dword [ebp - 0x1c], eax
cmp dword [eax + 0xc], 0
mov dword [ebp - 0x10], ecx
je 0x102ed92a
xor edi, edi
mov dword [ebp - 0xc], esi
mov ebx, ecx
test ecx, ecx
jle 0x102ed918
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x103fe900]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x102ed8f5
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov eax, edi
xor edx, edx
div dword [ebx + 0x19c]
mov eax, dword [ebp - 0x1c]
jmp 0x102ed92c
xor edx, edx
push edx
push ecx
mov edx, esi
mov ecx, eax
call fcn.102b78a0
add esp, 8
test eax, eax
je 0x102ed949
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
jmp 0x102ed956
mov edx, dword [ebp - 8]
xor ecx, ecx
mov al, byte [ebp - 1]
jmp 0x102ed956
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x102ed966
movzx eax, al
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
add ecx, 0xffffffec
cmp dword [ecx + 0xc], 0
jne 0x102ed985
inc edx
mov dword [ebp - 8], edx
cmp edx, 3
jl 0x102ed8b0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x20]
xor eax, eax
movdqu xmm0, xmmword [ecx]
pop edi
pop esi
movdqu xmmword [edx], xmm0
mov dword [edx + 0x10], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102f36d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], eax
push ebx
push esi
mov eax, dword [eax]
xor esi, esi
push edi
test dword [eax + 0x18], 0x40000
je 0x102f3812
mov ebx, dword [edx + 0x10]
test ebx, ebx
je 0x102f3735
lea esp, [esp]
mov edi, dword [ebx + 0x14]
test edi, edi
jle 0x102f372b
lea edx, [ebx + 0x24]
lea ebx, [ebx]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x102f371c
or eax, 0xffffffff
jmp 0x102f3723
mov eax, 1
shl eax, cl
or esi, eax
add edx, 8
dec edi
jne 0x102f3710
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x102f3700
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx]
mov edi, ecx
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x102f3753
cmp byte [ecx], 0
je 0x102f374b
inc edi
cmp byte [edi], 0
jne 0x102f3745
sub edi, ecx
and edi, 0x3fffffff
mov eax, dword [edx + 0x40]
xor edx, edx
add eax, 0x38
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
cmp dword [eax + 0xc], edx
je 0x102f379f
mov dword [ebp - 0x10], ecx
mov ebx, edi
test edi, edi
jle 0x102f3794
mov edi, ecx
movzx eax, byte [edi]
lea edi, [edi + 1]
dec ebx
movzx ecx, byte [eax + 0x103fe900]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test ebx, ebx
jg 0x102f3771
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 8]
mov eax, edx
xor edx, edx
div dword [ebx]
mov eax, ebx
push edx
mov edx, ecx
mov ecx, eax
push edi
call fcn.102b78a0
add esp, 8
test eax, eax
je 0x102f3812
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x102f3812
jmp 0x102f37c0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
push 0
push eax
push ebx
mov dword [ebp - 8], 0
call fcn.102f1ea0
mov edx, dword [ebp - 8]
add esp, 0xc
test edx, edx
je 0x102f380b
movzx edi, word [edx + 0x28]
test edi, edi
jle 0x102f380b
mov edx, dword [edx + 4]
mov edi, edi
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x102f37fc
or eax, 0xffffffff
jmp 0x102f3803
mov eax, 1
shl eax, cl
or esi, eax
add edx, 4
dec edi
jne 0x102f37f0
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x102f37c0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10330b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103c6870
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x104d9790]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.103363b9
mov dword [esi], 0x103cd680
lea ecx, [esi + 0x14]
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.1008123c
mov dword [esi], 0x103cd698
mov dword [esi + 0x2c], 0x103cd62c
mov ecx, dword [edi + 0x30]
mov dword [esp + 0x18], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x10330bf2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], 0x103cd870
mov dword [esi + 0x2c], 0x103cd87c
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10330c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103c6898
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x104d9790]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push esi
call fcn.103363b9
mov dword [edi], 0x103cd680
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.1008123c
mov dword [edi + 0x2c], 0x103cd62c
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], 0x103cd870
mov dword [edi + 0x2c], 0x103cd87c
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x10332620
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x10332690
push 0
push 0
call fcn.1033fca4
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x10332649
pop esi
xor al, al
pop ebx
ret
mov ecx, dword [esi]
mov eax, 1
push edi
add ecx, 4
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x1033266d
cmp eax, 0xffffffff
je 0x1033266d
push eax
call dword [0x103cb304]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [0x103cb1c4]
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x10335690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x103c71e0
mov eax, dword fs:[0]
push eax
push ebx
push ebp
mov eax, dword [0x104d9790]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 3
lea ebx, [ebx]
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x98]
mov ebx, dword [esp + 0x74]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
cmp ebp, dword [esp + 0x54]
jne 0x103356e1
cmp ecx, eax
je 0x1033575c
cmp ebx, dword [esp + 0x94]
jne 0x103356f0
cmp dword [esp + 0x78], edx
je 0x1033575c
cmp dword [esp + 0x70], 8
lea eax, [esp + 0x5c]
push dword [esp + 0x6c]
cmovae eax, dword [esp + 0x60]
lea ecx, [esp + 0x20]
push eax
push dword [esp + 0x34]
push 0
call fcn.100893eb
test eax, eax
js 0x103357ab
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
push dword [esp + 0x2c]
cmovae eax, dword [esp + 0x20]
lea ecx, [esp + 0x60]
push eax
push dword [esp + 0x74]
push 0
call fcn.100893eb
test eax, eax
js 0x103357a4
lea eax, [esp + 0x1c]
push eax
call fcn.10335950
lea eax, [esp + 0x60]
push eax
call fcn.10335950
add esp, 8
jmp 0x103356c0
cmp ebp, dword [esp + 0x54]
jne 0x10335792
cmp ecx, eax
jne 0x10335792
cmp ebx, dword [esp + 0x94]
jne 0x10335779
cmp dword [esp + 0x78], edx
jne 0x10335779
xor ebx, ebx
jmp 0x103357ae
cmp ecx, eax
jne 0x10335792
xor ebx, ebx
mov eax, 1
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x103357ae
xor ebx, ebx
xor eax, eax
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x103357ae
mov ebx, 1
jmp 0x103357ae
or ebx, 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x103357c1
push dword [esp + 0x1c]
call fcn.1031e459
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
cmp dword [esp + 0x50], 8
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
jb 0x103357eb
push dword [esp + 0x3c]
call fcn.1031e459
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
cmp dword [esp + 0x70], 8
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x10335815
push dword [esp + 0x5c]
call fcn.1031e459
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
cmp dword [esp + 0x90], 8
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
jb 0x10335842
push dword [esp + 0x7c]
call fcn.1031e459
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4013e0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x20a
call fcn.004014b8
add esp, 4
mov esi, eax
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
push str.DU_APPFOLDER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.00401040
mov esi, eax
add esp, 4
test esi, esi
jne 0x40144a
push str.No_executable_found
push 2
call fcn.00403c3d
add esp, 4
push eax
call fcn.00401010
add esp, 8
mov eax, 0x2389
pop esi
pop ebp
ret
push edi
push dword [esi]
call fcn.00403cc1
add esp, 4
mov edi, eax
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push edi
push str.Loading__s_..._n
push 2
call fcn.00403c3d
add esp, 4
push eax
call fcn.00401010
push esi
push edi
push 0
call fcn.00405812
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
jne 0x4014a1
push edi
push str.Failed_to_start_executable__s_n
push 2
call fcn.00403c3d
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40725f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x407281
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00406df6
push eax
push esi
push dword [ebp + 8]
jne 0x407259
call fcn.00406dab
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00406de6
jg 0x407230
mov gs, esp
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00406de6
inc ecx
div bl
mov bh, 0x8d
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]

Function at 0x40af6f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040abec
Function at 0x4013cf
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x508ce0
jmp 0x4013c3
mov eax, 0x4c7ae4
call fcn.00497084
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004014f4
mov eax, dword [0x5046b0]
lea ecx, [esi + 0xac]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ecx], eax
mov eax, dword [0x5046b0]
mov dword [esi + 0xb4], eax
push 1
mov dword [esi], 0x4cf7cc
pop eax
mov ebx, 0x508cdc
push 0xa
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 7
or dword [esi + 0x28], 0xffffffff
or dword [esi + 0x24], 0xffffffff
pop edx
push 0x64
mov dword [esi + 0x30], edi
mov dword [esi + 0x64], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x2c], edi
pop edx
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], eax
push ebx
mov byte [ebp - 4], 2
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], 5
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x9c], edx
mov dword [esi + 0xa0], edx
mov dword [esi + 0xa4], edi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], 0x3e8
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 0xc0
mov dword [esi + 0x90], 0x6c
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], edi
mov dword [esi + 0xa8], edi
call fcn.004b238d
push ebx
lea ecx, [esi + 0xb4]
mov dword [esi + 0xb0], edi
call fcn.004b238d
or dword [esi + 0xc0], 0xffffffff
or dword [esi + 0xbc], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xb8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40d5fc
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4c8aa4
call fcn.00497084
sub esp, 0x22c
push ebx
push esi
mov dword [ebp - 0x2c], ecx
mov esi, 0x508da8
push str.DataFile_Types
mov ecx, esi
call fcn.004c4ff6
xor ebx, ebx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x40d632
xor eax, eax
jmp 0x40d77a
mov eax, dword [0x5046b0]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 2
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x24], pe_nt_image_headers32
mov dword [ebp - 0x20], ebx
call edi
cmp eax, 0x103
je 0x40d74a
lea eax, [ebp - 0x238]
push eax
push str.DataFile_Types
lea eax, [ebp - 0x10]
push 0x4f0058
push eax
call fcn.004afb27
add esp, 0x10
lea eax, [ebp - 0x28]
mov ecx, esi
push ebx
push str.Name
push dword [ebp - 0x10]
push eax
call fcn.004c50a8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004b233d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004b21f6
push ebx
push str.Extension
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c50a8
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004b233d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004b21f6
push 0xffffffffffffffff
push str.Icon
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004c503c
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 8], ebx
je 0x40d723
mov edx, dword [ebp - 0x1c]
cmp dword [edx - 8], ebx
je 0x40d723
cmp eax, 0xffffffff
je 0x40d723
push eax
push edx
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0040d867
lea eax, [ebp - 0x38]
inc dword [ebp - 0x20]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x24], pe_nt_image_headers32
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x18]
jmp 0x40d66e
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004b21f6
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004b21f6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004b21f6
push 1
pop eax
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40e8d0
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov edi, 0x4d24a8
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, 0x2b4
lea eax, [ebp - 0x2bc]
push esi
push ebx
push eax
call fcn.004970b0
lea eax, [ebp - 8]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 8], ebx
mov eax, dword [eax]
sete cl
or cx, 0x4008
push ecx
lea ecx, [ebp - 0x2bc]
push esi
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 8]
mov esi, eax
neg ecx
sbb ecx, ecx
lea eax, [ebp - 4]
and ecx, eax
mov dword [ebp - 8], edi
call fcn.0040ec44
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4