joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479434
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, eax
mov byte [esp + 4], 0
mov edx, esp
mov eax, edi
call fcn.00479020
mov eax, dword [edi + 0x88]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4794cf
mov eax, dword [edi + 0x88]
mov edx, esi
call fcn.00414f84
mov ebp, eax
mov eax, dword [esp]
mov ebx, dword [eax + 8]
dec ebx
cmp ebx, 0
jl 0x47949d
mov edx, ebx
mov eax, dword [esp]
call fcn.00414f84
mov eax, dword [eax + 0x4c]
mov eax, dword [eax + 4]
mov edx, dword [ebp + 0x4c]
cmp eax, dword [edx + 4]
jne 0x479497
cmp byte [ebp + 8], 0
je 0x479497
xor ebp, ebp
jmp 0x47949d
dec ebx
cmp ebx, 0xffffffff
jne 0x479475
test ebp, ebp
je 0x4794c9
mov eax, ebp
call fcn.00478870
mov edx, ebp
mov eax, edi
call fcn.0047932c
cmp byte [ebp + 9], 0
jne 0x4794c4
mov eax, dword [edi + 0x88]
mov edx, esi
call fcn.00414e74
mov byte [esp + 4], 1
dec esi
cmp esi, 0xffffffff
jne 0x47945a
mov eax, dword [esp]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x47956b
inc eax
mov dword [esp + 8], eax
xor esi, esi
mov eax, dword [edi + 0x88]
mov ebp, dword [eax + 8]
dec ebp
test ebp, ebp
jl 0x479560
inc ebp
xor ebx, ebx
mov edx, esi
mov eax, dword [esp]
call fcn.00414f84
mov eax, dword [eax + 0x4c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [edi + 0x88]
mov edx, ebx
call fcn.00414f84
mov eax, dword [eax + 0x4c]
pop edx
cmp edx, dword [eax + 4]
jne 0x47955c
mov eax, dword [edi + 0x88]
mov edx, ebx
call fcn.00414f84
cmp byte [eax + 8], 0
je 0x47955c
mov edx, esi
mov eax, dword [esp]
call fcn.00414f84
xor edx, edx
mov dword [eax + 4], edx
mov edx, esi
mov eax, dword [esp]
call fcn.00414f84
call fcn.00403ce4
xor ecx, ecx
mov edx, esi
mov eax, dword [esp]
call fcn.004150d0
jmp 0x479560
inc ebx
dec ebp
jne 0x4794f6
inc esi
dec dword [esp + 8]
jne 0x4794e5
mov eax, dword [esp]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4795c1
inc eax
mov dword [esp + 8], eax
xor esi, esi
mov edx, esi
mov eax, dword [esp]
call fcn.00414f84
test eax, eax
je 0x4795ba
mov edx, esi
mov eax, dword [esp]
call fcn.00414f84
mov edx, eax
mov eax, dword [edi + 0x88]
call fcn.00414e28
mov byte [esp + 4], 1
mov edx, esi
mov eax, dword [esp]
call fcn.00414f84
mov edx, eax
mov eax, edi
call fcn.0047930c
inc esi
dec dword [esp + 8]
jne 0x47957d
mov eax, dword [esp]
call fcn.00403ce4
xor eax, eax
mov dword [edi + 0x8c], eax
xor eax, eax
mov dword [edi + 0x90], eax
xor eax, eax
mov dword [edi + 0x94], eax
mov eax, dword [edi + 0x88]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x479633
inc eax
mov dword [esp + 8], eax
xor esi, esi
mov eax, dword [edi + 0x88]
mov edx, esi
call fcn.00414f84
mov ebp, eax
mov al, byte [ebp + 9]
xor al, 1
and eax, 0x7f
add dword [edi + 0x8c], eax
xor eax, eax
mov al, byte [ebp + 9]
add dword [edi + 0x90], eax
mov al, byte [ebp + 8]
xor al, 1
and eax, 0x7f
add dword [edi + 0x94], eax
inc esi
dec dword [esp + 8]
jne 0x4795f6
mov eax, dword [edi + 0x94]
sub dword [edi + 0x90], eax
cmp byte [esp + 4], 0
jne 0x47964c
cmp byte [edi + 0x78], 0
jne 0x479653
mov eax, edi
call fcn.0047934c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xdfdd78
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdfdd82
pushal
call 0xdfdd88
pop ebp
sub ebp, 0x10
sub ebp, 0x9fdd78
jmp 0xdfdd9e
mov eax, 0x9fdd78
add eax, ebp
add eax, 0x4c
mov ecx, 0x5df
mov edx, 0xf59968cd
xor byte [eax], dl
inc eax
dec ecx
jne 0xdfddb5
jmp 0xdfddc8
inc esi
add byte [esi + 0x44], al
int1
int 0xcd
int 0x4c
or al, 0x35
int 0xcd
int 0xce
add byte [ebp - 0x35], dh
int 0xcd
int 0x77
in eax, 0xcd
int 0xcd
cmp ch, byte [edi]
into
add eax, 0xcdc14c46
int 0xcd
into
or byte [eax - 0x57], al
jmp 0xeaa92226
Function at 0x401470
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x424
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x420], eax
push ebp
mov ebp, dword [esp + 0x42c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x226]
push ecx
mov dword [esp + 0x10], 0xffffffff
mov word [esp + 0x228], ax
call fcn.00406ac0
xor edx, edx
add esp, 0xc
cmp edx, str.RAV.INI
je 0x4015f4
mov eax, str.RAV.INI
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4014d0
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x4015f4
push esi
lea esi, [esp + 0x220]
call fcn.00401700
mov eax, esi
mov ecx, 0x104
pop esi
lea ecx, [ecx]
cmp word [eax], 0
je 0x401510
add eax, 2
sub ecx, 1
jne 0x401500
jmp 0x401533
test ecx, ecx
je 0x401533
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x21c]
mov eax, str.RAV.INI
call fcn.00401cd0
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00406ac0
add esp, 0xc
lea edx, [esp + 0x21c]
push edx
push 0x104
lea eax, [esp + 0x18]
push eax
push 0x41a1c0
push ebx
push str.DEBUG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
mov dword [esp + 4], eax
je 0x4015f4
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push 0x41a204
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call fcn.00405c85
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
ja 0x4015f6
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push str.0X_X
push edx
call fcn.00405c85
mov eax, dword [esp + 0x14]
add esp, 0xc
test eax, eax
ja 0x4015f6
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x14]
push 0x41a218
push ecx
call fcn.00405c85
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
ja 0x4015f6
mov eax, ebp
mov ecx, dword [esp + 0x424]
pop ebp
xor ecx, esp
call fcn.0040531f
add esp, 0x424
ret

Function at 0x401610
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
or esi, 0xffffffff
mov word [esp + 0x10], ax
call fcn.00406ac0
xor edx, edx
add esp, 0xc
cmp edx, str.RAV.INI
je 0x4016e4
mov eax, str.RAV.INI
lea edx, [eax + 2]
jmp 0x401660
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401660
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x4016e4
lea esi, [esp + 4]
call fcn.00401700
mov ecx, 0x104
mov eax, esi
cmp word [eax], 0
je 0x401694
add eax, 2
sub ecx, 1
jne 0x401684
jmp 0x4016b4
test ecx, ecx
je 0x4016b4
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 4]
mov eax, str.RAV.INI
call fcn.00401cd0
lea eax, [esp + 4]
push eax
push 0x200
push str.LOGSIZE
push str.DEBUG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040531f
add esp, 0x20c
ret
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040531f
add esp, 0x20c
ret
Function at 0x401700
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x218], eax
xor eax, eax
cmp eax, 0x41a220
je 0x40180b
test esi, esi
je 0x40180b
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1e]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 1
mov word [esp + 0x20], cx
call fcn.00406ac0
push 0x41a220
push str.SOFTWARERising_s
mov eax, 0x104
lea edi, [esp + 0x28]
call fcn.00401ac0
add esp, 0x14
lea eax, [esp + 4]
push eax
push 0x20019
push 0
mov ecx, edi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017e1
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
push esi
lea eax, [esp + 0x14]
push eax
push 0
push 0x41a1f0
push ecx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4017b4
sub eax, edx
sar eax, 1
je 0x4017d6
push 0x41a1ec
mov edx, 0x104
mov edi, esi
call fcn.00401d20
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4017e7
sub eax, edx
sar eax, 1
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0040531f
add esp, 0x21c
ret
mov ecx, dword [esp + 0x218]
xor ecx, esp
xor eax, eax
call fcn.0040531f
add esp, 0x21c
ret

Function at 0x401830
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
or esi, 0xffffffff
mov word [esp + 0x10], ax
call fcn.00406ac0
xor edx, edx
add esp, 0xc
cmp edx, str.RAV.INI
je 0x40190e
mov eax, str.RAV.INI
lea edx, [eax + 2]
jmp 0x401880
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401880
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x40190e
lea esi, [esp + 4]
call fcn.00401700
mov ecx, 0x104
mov eax, esi
cmp word [eax], 0
je 0x4018b4
add eax, 2
sub ecx, 1
jne 0x4018a4
jmp 0x4018d4
test ecx, ecx
je 0x4018d4
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 4]
mov eax, str.RAV.INI
call fcn.00401cd0
lea eax, [esp + 4]
push eax
push 0x105
push 0x41e2e8
push 0x41a1c0
push str.LOGNAME
push str.DEBUG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040531f
add esp, 0x20c
ret
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040531f
add esp, 0x20c
ret
Function at 0x401930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00401830
cmp word [0x41e2e8], 0
jne 0x401a1e
push ebp
push esi
push 0x105
push 0x41e2e8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x41e2e8
mov ebp, eax
call fcn.00405762
mov esi, eax
add esp, 8
test esi, esi
je 0x401a00
push ebx
push edi
sub eax, 0x41e2e8
sar eax, 1
mov edi, ebp
sub edi, eax
add edi, edi
push edi
lea ebx, [esi + 0x12]
push esi
push ebx
call fcn.004058b0
mov ecx, dword [str.logfiles]
mov dword [esi], ecx
mov edx, dword [0x41a3a8]
mov dword [esi + 4], edx
mov eax, dword [0x41a3ac]
mov dword [esi + 8], eax
mov ecx, dword [0x41a3b0]
mov dword [esi + 0xc], ecx
mov dx, word [0x41a3b4]
add esp, 0xc
xor eax, eax
mov word [esi + 0x10], dx
push 0x41e2e8
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x5c
mov word [ebx], cx
cmp eax, 0xffffffff
je 0x4019e9
test al, 0x10
je 0x4019e9
xor edx, edx
mov word [ebp*2 + 0x41e2fa], dx
jmp 0x4019fe
push edi
push ebx
push esi
call fcn.004058b0
add esp, 0xc
xor eax, eax
mov word [ebp*2 + 0x41e2e8], ax
pop edi
pop ebx
pop esi
mov ecx, 0x104
mov eax, 0x41e2e8
pop ebp
lea esp, [esp]
cmp word [eax], 0
je 0x401a1f
add eax, 2
sub ecx, 1
jne 0x401a10
ret
test ecx, ecx
je 0x401a1e
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [eax*2 + 0x41e2e8]
mov eax, str..log
jmp fcn.00401cd0
Function at 0x402e60
Capabilities:
Create directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x16]
push ecx
mov edi, 1
mov word [esp + 0x18], ax
call fcn.00406ac0
add esp, 0xc
test esi, esi
je 0x402ebb
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call ebx
test eax, eax
jle 0x402ebb
push esi
call ebx
cmp eax, 0x208
jbe 0x402ed5
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040531f
add esp, 0x20c
ret
push 0x207
push esi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov esi, eax
push esi
call ebx
test eax, eax
jne 0x402f1f
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040531f
add esp, 0x20c
ret
push ebp
push 0x5c
push esi
call fcn.0040578e
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
add esp, 8
test esi, esi
je 0x402f7a
lea ecx, [ecx]
xor edx, edx
push edx
lea eax, [esp + 0x14]
push eax
mov word [esi], dx
call ebx
and edi, eax
jne 0x402f5f
call ebp
cmp eax, 0xb7
jne 0x402f5f
mov edi, 1
mov ecx, 0x5c
mov word [esi], cx
push ecx
add esi, 2
push esi
call fcn.0040578e
mov esi, eax
add esp, 8
test esi, esi
jne 0x402f40
push 0
lea edx, [esp + 0x14]
push edx
call ebx
and edi, eax
jne 0x402f95
call ebp
cmp eax, 0xb7
jne 0x402f95
mov edi, 1
mov ecx, dword [esp + 0x218]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040531f
add esp, 0x20c
ret
Function at 0x404df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404e07
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404e38
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x404e34
cmp esi, eax
jae 0x404e38
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x404e24
cmp esi, eax
jb 0x404e3e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x40531f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c040]
jne 0x405329
repz ret
jmp fcn.00406d2c

Function at 0x410b07
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004078ac
and dword [ebp - 4], 0
cmp dword [0x41e1f4], 0
mov ebx, eax
jne 0x410bb8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410c69
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x410c69
push eax
call fcn.0040783a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41e1f4], eax
call esi
push eax
call fcn.0040783a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41e1f8], eax
call esi
push eax
call fcn.0040783a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41e1fc], eax
call esi
push eax
call fcn.0040783a
pop ecx
mov dword [0x41e204], eax
test eax, eax
je 0x410bb8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040783a
pop ecx
mov dword [0x41e200], eax
mov eax, dword [0x41e200]
cmp eax, ebx
je 0x410c10
cmp dword [0x41e204], ebx
je 0x410c10
push eax
call fcn.004078b5
push dword [0x41e204]
mov esi, eax
call fcn.004078b5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410c10
test edi, edi
je 0x410c10
call esi
test eax, eax
je 0x410c07
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410c07
test byte [ebp - 0xc], 1
jne 0x410c10
or dword [ebp + 0x10], 0x200000
jmp 0x410c49
mov eax, dword [0x41e1f8]
cmp eax, ebx
je 0x410c49
push eax
call fcn.004078b5
pop ecx
test eax, eax
je 0x410c49
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410c49
mov eax, dword [0x41e1fc]
cmp eax, ebx
je 0x410c49
push eax
call fcn.004078b5
pop ecx
test eax, eax
je 0x410c49
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41e1f4]
call fcn.004078b5
pop ecx
test eax, eax
je 0x410c69
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410c6b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002bb1
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002b72
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x407278
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x14]
push esi
mov esi, edx
mov dword [ebp - 0x38], ebx
push edi
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
call fcn.004071bc
mov edi, dword [ebp - 0x14]
mov eax, dword [esi + 8]
add edi, 0x23f
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 0xc]
mov eax, edx
mov ecx, dword [0x1a3b674]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x407300
push 0x401118
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [0x1a3b674]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x1a3b6b8]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x1a3b6b8], eax
mov eax, dword [0x1a3b6c0]
cmove eax, dword [ebp - 0x24]
mov dword [0x1a3b6c0], eax
lea eax, [edi + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x1a3b6bc], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x1c]
sub ebx, eax
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [ebp - 0x1c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
cmp dword [0x1a3b674], 0xb03
jne 0x4073d7
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0x40111c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4072c8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x38]
pop edi
pop esi
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407421
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
shr esi, 3
push edi
mov edi, ecx
test esi, esi
je 0x40745f
cmp dword [0x1a3b674], 0x959
jne 0x40744f
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00407278
add edi, 8
dec esi
jne 0x407431
pop edi
pop esi
pop ebp
ret 4
Function at 0x410bff
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x449ca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a833
mov dword [ebp - 0x14], eax
cmp dword [0x1a3c454], esi
jne 0x410cf2
push 0x800
push esi
push 0x40515c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x410c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x410dd2
push esi
push esi
push 0x40515c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x410dd2
push 0x405174
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410dd2
push eax
call ebx
push 0x405180
push edi
mov dword [0x1a3c454], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405190
push edi
mov dword [0x1a3c458], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4051a4
push edi
mov dword [0x1a3c45c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1a3c464], eax
test eax, eax
je 0x410cef
push 0x4051c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1a3c460], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x410d17
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410d0a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x410d2c
push 4
pop eax
jmp 0x410dd4
cmp dword [ebp - 0x14], esi
je 0x410d2c
push dword [0x1a3c454]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410d11
mov eax, dword [0x1a3c460]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x410d8a
cmp dword [0x1a3c464], edi
je 0x410d8a
push eax
call ebx
push dword [0x1a3c464]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x410d8a
test eax, eax
je 0x410d8a
call ecx
test eax, eax
je 0x410d7f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x410d7f
test byte [ebp - 8], 1
jne 0x410d8a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x410dba
mov eax, dword [0x1a3c458]
cmp eax, edi
je 0x410db7
push eax
call ebx
test eax, eax
je 0x410db7
call eax
mov esi, eax
test esi, esi
je 0x410db7
mov eax, dword [0x1a3c45c]
cmp eax, edi
je 0x410db7
push eax
call ebx
test eax, eax
je 0x410db7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1a3c454]
call ebx
test eax, eax
je 0x410dd2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x410dd4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409e6e
mov esp, ebp
pop ebp
ret