joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c06a
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb0
push ebx
push esi
push edi
push dword [ebp + 0x7c]
call fcn.00403bda
add esp, 4
test eax, eax
je 0x40c190
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push dword [ebp + 0x7c]
call esi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x40c190
mov word [edi], bx
inc edi
push 0x2c
inc edi
push edi
call esi
cmp eax, ebx
je 0x40c190
mov word [eax], bx
add eax, 2
push eax
call fcn.00403bbc
pop ecx
push 0x2c
push eax
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x70], 1
call esi
cmp eax, ebx
je 0x40c0fc
mov word [eax], bx
add eax, 2
push eax
call fcn.00403bbc
push eax
call fcn.00402463
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 0x70], eax
jge 0x40c0fc
mov dword [ebp + 0x70], ebx
push edi
call fcn.00403bbc
mov esi, dword [sym.imp.USER32.dll_CharUpperW]
pop ecx
push eax
call esi
push eax
mov dword [ebp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 0x6c], ebx
jle 0x40c147
push dword [ebp + 0x68]
call esi
xor edx, edx
xor ecx, ecx
cmp edi, ebx
jle 0x40c147
movzx eax, word [eax]
mov esi, dword [ebp + 0x64]
cmp word [esi + ecx*2], ax
jne 0x40c189
inc edx
cmp dword [ebp + 0x70], ebx
jle 0x40c183
cmp edx, dword [ebp + 0x70]
jne 0x40c189
inc ecx
mov dword [ebp + 0x6c], ecx
push 0x9e
lea eax, [ebp - 0x3a]
push ebx
push eax
mov word [ebp - 0x3c], bx
call sub.MSVCRT.dll_memset
push dword [ebp + 0x6c]
lea eax, [ebp - 0x3c]
push 0x4017b4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x40c193
lea esi, [ecx + 1]
mov dword [ebp + 0x6c], esi
inc ecx
cmp ecx, edi
jl 0x40c12f
jmp 0x40c147
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x40c19b
Capabilities:
Set environment variable

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
call fcn.00403bda
add esp, 4
test eax, eax
je 0x40c223
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push dword [esp + 0x10]
call ebx
mov esi, eax
test esi, esi
je 0x40c223
and word [esi], 0
push edi
inc esi
push 0x2c
inc esi
push esi
xor edi, edi
call ebx
test eax, eax
je 0x40c1f1
and word [eax], di
add eax, 2
push eax
call fcn.00403bbc
push eax
call fcn.00402463
pop ecx
pop ecx
mov edi, eax
push esi
call fcn.00403bbc
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
jl 0x40c209
test edi, edi
jne 0x40c20b
mov edi, eax
and word [esi + edi*2], 0
push esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop edi
jmp 0x40c226
xor eax, eax
inc eax
pop esi
pop ebx
ret
Function at 0x40c229
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00403bda
add esp, 4
test eax, eax
je 0x40c302
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
je 0x40c302
and word [ebx], 0
inc ebx
push 0x2c
inc ebx
push ebx
call esi
mov edi, eax
test edi, edi
je 0x40c302
and word [edi], 0
inc edi
push 0x2c
inc edi
push edi
mov dword [ebp - 4], 1
call esi
test eax, eax
je 0x40c2a5
and word [eax], 0
add eax, 2
push eax
call fcn.00403bbc
push eax
call fcn.00402463
pop ecx
pop ecx
mov dword [ebp - 4], eax
push edi
call fcn.00403bbc
push eax
call fcn.00402463
push ebx
mov esi, eax
call fcn.00403bbc
add esp, 0xc
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, 1
jge 0x40c2cd
xor esi, esi
inc esi
cmp esi, eax
jle 0x40c2d4
lea esi, [eax + 1]
cmp dword [ebp - 4], eax
jg 0x40c2df
cmp dword [ebp - 4], 0
jne 0x40c2e2
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, esi
and word [edi + eax*2 - 2], 0
lea eax, [edi + esi*2 - 2]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x40c305
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c30a
Capabilities:
Set environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebx
call fcn.00403bda
add esp, 4
test eax, eax
je 0x40c376
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3d
push ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x40c376
and word [eax], 0
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x5c
push 0
add eax, 2
push eax
call edi
mov esi, eax
test esi, esi
je 0x40c35e
push 0x2e
inc esi
push 0
inc esi
push esi
call edi
test eax, eax
je 0x40c35e
and word [eax], 0
push esi
call fcn.00403bbc
pop ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret
xor eax, eax
inc eax
pop ebx
ret
Function at 0x40c37b
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00410150
push esi
push edi
push dword [ebp + 8]
call fcn.00403bda
add esp, 4
test eax, eax
je 0x40c4b6
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
je 0x40c4b6
and word [edi], 0
inc edi
push 0x2c
inc edi
push edi
call esi
test eax, eax
je 0x40c4b6
and word [eax], 0
add eax, 2
push ebx
push eax
call fcn.00403bbc
pop ecx
mov ebx, eax
push 0x2c
push ebx
mov dword [ebp - 4], 1
call esi
test eax, eax
je 0x40c410
and word [eax], 0
add eax, 2
push eax
call fcn.00403bbc
push eax
call fcn.00402463
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jge 0x40c410
and dword [ebp - 4], 0
push edi
call fcn.00403bbc
mov esi, dword [sym.imp.USER32.dll_CharUpperW]
pop ecx
push eax
call esi
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [ebp - 8], 0
mov edi, eax
test edi, edi
jle 0x40c45d
push ebx
call esi
lea ecx, [edi - 1]
xor edx, edx
cmp ecx, 0xffffffff
jle 0x40c45d
movzx eax, word [eax]
mov esi, dword [ebp - 0xc]
cmp word [esi + ecx*2], ax
jne 0x40c4ae
inc edx
cmp dword [ebp - 4], 0
jle 0x40c4a8
cmp edx, dword [ebp - 4]
jne 0x40c4ae
inc ecx
mov dword [ebp - 8], ecx
and word [ebp - 0x100c], 0
push 0xffe
lea eax, [ebp - 0x100a]
push 0
push eax
call sub.MSVCRT.dll_memset
push dword [ebp - 8]
lea eax, [ebp - 0x100c]
push 0x4017b4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop ebx
jmp 0x40c4b9
lea esi, [ecx + 1]
mov dword [ebp - 8], esi
dec ecx
cmp ecx, 0xffffffff
jg 0x40c444
jmp 0x40c45d
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x40c4bd
Capabilities:
Set environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
call fcn.00403bda
add esp, 4
test eax, eax
je 0x40c540
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push ebp
call ebx
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x40c540
mov word [esi], di
inc esi
push 0x2c
inc esi
push esi
call ebx
test eax, eax
je 0x40c511
and word [eax], di
add eax, 2
push eax
call fcn.00403bbc
push eax
call fcn.00402463
pop ecx
pop ecx
mov edi, eax
push esi
call fcn.00403bbc
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp edi, 1
jge 0x40c528
mov edi, eax
sub eax, edi
jns 0x40c52e
xor eax, eax
lea eax, [esi + eax*2]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x40c543
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40c548
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa0
push dword [ebp + 0x7c]
call fcn.00403bda
add esp, 4
test eax, eax
je 0x40c5ce
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3d
push dword [ebp + 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x40c5ce
and word [eax], 0
add eax, 2
push edi
push eax
call fcn.00403bbc
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
and word [ebp - 0x2c], 0
push 0x9e
mov edi, eax
lea eax, [ebp - 0x2a]
push 0
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x2c]
push 0x4017b4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop edi
jmp 0x40c5d1
xor eax, eax
inc eax
add ebp, 0x74
leave
ret

Function at 0x40c5fd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x208
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
jne 0x40c619
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x206
mov dword [0x4122d8], eax
lea eax, [ebp - 0x206]
push ebx
push eax
mov word [ebp - 0x208], bx
call sub.MSVCRT.dll_memset
push 1
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.004045f0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, 0x104
push edi
push 0x412590
push ebx
mov dword [0x4122e0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x4122e8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
call fcn.00403bef
push 0xc
push 0x401488
push 0x412798
call fcn.00403f37
mov eax, dword [ebp + 0xc]
add esp, 0x10
pop edi
pop esi
cmp eax, ebx
pop ebx
jne 0x40c69c
call fcn.0040c5e7
mov dword [0x412088], eax
leave
ret

Function at 0x40d4bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x10]
xor edi, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, edi
je 0x40d539
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 1
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
jbe 0x40d538
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [esi]
mov ebx, eax
call fcn.00402390
pop ecx
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [esi]
push ebx
push edi
call sub.MSVCRT.dll_memmove
mov eax, dword [esi]
add esp, 0xc
push ebx
mov byte [edi + eax], 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
je 0x40d538
cmp dword [esi], 4
jbe 0x40d538
push dword [ebp + 0x18]
push esi
push edi
call fcn.0040d443
add esp, 0xc
mov edi, eax
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d5b3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push pe_nt_image_headers32
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call sub.MSVCRT.dll_memset
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
inc edi
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x54], 0x4020ec
mov dword [ebp - 0x30], edi
mov word [ebp - 0x2c], di
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
xor ecx, ecx
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp ax, 0x21
jne 0x40d60b
mov dword [ebp - 4], edi
jmp 0x40d637
cmp ax, 0x40
jne 0x40d61a
mov dword [ebp - 0x54], 0x4020c8
jmp 0x40d637
cmp ax, 0x3d
jne 0x40d625
mov dword [ebp - 8], edi
jmp 0x40d637
cmp ax, 0x24
jne 0x40d62f
mov edx, edi
jmp 0x40d637
cmp ax, 0x23
jne 0x40d63d
mov ecx, edi
add dword [ebp + 8], 2
jmp 0x40d5fa
cmp ecx, ebx
je 0x40d695
push 0x20
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x40d657
mov word [esi], bx
inc esi
inc esi
push dword [ebp + 8]
call fcn.00402463
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], ebx
call fcn.0040d590
add esp, 0xc
cmp eax, ebx
je 0x40d68e
xor ecx, ecx
cmp dword [ebp - 4], ebx
push esi
sete cl
push ecx
push dword [ebp + 8]
push eax
call fcn.00407128
add esp, 0x10
jmp 0x40d742
mov eax, edi
jmp 0x40d742
cmp edx, ebx
jne 0x40d6fe
cmp dword [ebp - 4], ebx
je 0x40d6a2
mov word [ebp - 0x2c], bx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, ebx
je 0x40d6f3
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4122e0]
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
cmp dword [ebp - 8], ebx
je 0x40d6e0
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x18]
call edi
xor edi, edi
inc edi
xor eax, eax
cmp esi, ebx
sete al
cmp eax, ebx
je 0x40d73b
push ebx
push dword [ebp + 8]
mov esi, edi
call fcn.004070eb
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
mov edi, eax
je 0x40d714
xor esi, esi
push dword [ebp + 8]
call fcn.004070ce
pop ecx
push esi
push ebx
push edi
push eax
push 0x4020bc
push dword [0x4122d4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1f
pop ecx
cmp ecx, eax
sbb esi, esi
neg esi
xor eax, eax
cmp esi, ebx
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ef83
Capabilities:
Get common file path
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
push ebx
push esi
xor esi, esi
push 0x206
lea eax, [ebp - 0x42e]
push esi
push eax
mov word [ebp - 0x430], si
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x638]
push esi
push eax
call fcn.0040d983
mov ebx, eax
add esp, 0xc
cmp ebx, esi
jne 0x40efdb
xor eax, eax
inc eax
jmp 0x40f091
push edi
push 0x226
lea eax, [ebp - 0x226]
push esi
push eax
mov word [ebp - 0x228], si
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x228]
push eax
mov esi, 0x402144
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x430]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x638]
push eax
call fcn.0040a61e
push ebx
call fcn.0040a55d
push ebx
mov edi, eax
call sub.MSVCRT.dll_free
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40f062
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x402140
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x228]
push eax
call fcn.0040a61e
pop ecx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f095
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
and word [ebp - 0x800], 0
push ebx
mov ebx, dword [0x4122e4]
push edi
push 0x7fe
lea eax, [ebp - 0x7fe]
push 0
push eax
call sub.MSVCRT.dll_memset
mov edi, dword [ebp + 8]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jle 0x40f125
cmp word [edi], 0x5c
je 0x40f0e0
cmp word [edi + 2], 0x3a
jne 0x40f12f
push edi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x800]
push eax
call fcn.0040a663
lea eax, [ebp - 0x800]
push eax
call fcn.0040258f
test eax, eax
pop ecx
pop ecx
je 0x40f119
lea eax, [ebp - 0x800]
push eax
call fcn.0040ef83
pop ecx
pop edi
mov dword [0x4122e4], ebx
xor eax, eax
pop ebx
leave
ret
test eax, eax
jle 0x40f12f
cmp word [edi], 0x5c
je 0x40f0e0
push esi
lea eax, [ebp - 0x800]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x402140
lea eax, [ebp - 0x800]
push eax
call esi
push edi
lea eax, [ebp - 0x800]
push eax
call esi
pop esi
jmp 0x40f0ee
Function at 0x40f4ee
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x710
push ebx
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x216]
push edi
push eax
mov word [ebp - 0x218], di
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp + 8]
add esp, 0xc
cmp word [ebx], 0x5c
jne 0x40f586
lea eax, [ebp - 0x4c0]
push eax
inc ebx
push 0x104
inc ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x4c0], di
lea esi, [ebp - 0x4c0]
je 0x40f656
push ebx
push esi
lea eax, [ebp - 0x218]
push 0x401ae8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push dword [ebp + 0x10]
lea eax, [ebp - 0x218]
push dword [ebp + 0xc]
push eax
call fcn.0040f4ee
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], di
jne 0x40f548
jmp 0x40f656
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push ebx
lea eax, [ebp - 0x218]
push 0x40216c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x710]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x40f5c2
push 2
pop eax
jmp 0x40f658
lea eax, [ebp - 0x6e4]
push eax
push ebx
lea eax, [ebp - 0x218]
push 0x402158
push eax
call esi
add esp, 0x10
cmp dword [ebp + 0x10], edi
je 0x40f60f
push edi
push 0x50
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetINFClassW]
push dword [ebp + 0x10]
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40f635
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0xc]
call fcn.0040f480
cmp eax, edi
pop ecx
pop ecx
je 0x40f635
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0040651c
add esp, 0xc
lea eax, [ebp - 0x710]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40f5c2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f9e9
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2c
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
je 0x40fa0f
mov word [esi], bx
inc esi
inc esi
cmp word [edi], 0x24
jne 0x40fa20
add edi, 2
push edi
call fcn.0040f9a3
jmp 0x40fa26
push edi
call fcn.0040f44e
pop ecx
push 0x206
mov edi, eax
lea eax, [ebp - 0x206]
push ebx
push eax
mov word [ebp - 0x208], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp esi, ebx
push edi
je 0x40fa58
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x40faa1
call fcn.00403fc1
pop ecx
mov esi, eax
cmp esi, ebx
push 0x50
lea eax, [ebp - 0x208]
push eax
je 0x40fa74
push 0x2721
jmp 0x40fa79
push 0x2722
push dword [0x4122d8]
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x208]
push eax
push edi
push dword [0x4122d4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
cmp esi, ebx
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401950
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x10]
cmp esi, 0x10000
ja 0x401ad0
mov eax, dword [ebx + 4]
test eax, eax
je 0x40199c
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateThread_8
mov eax, dword [ebx + 4]
sub esp, 8
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebx]
test eax, eax
je 0x4019ad
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
xor eax, eax
test esi, esi
jne 0x4019c0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._memset
xor eax, eax
mov dword [ebx + eax], 0
add eax, 4
cmp eax, 0x18
jb 0x4019d9
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [0x409034], eax
mov eax, edi
mov dword [0x409030], edx
shr eax, 1
xor edx, edx
shld edx, eax, 0x10
shl eax, 0x10
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call dbg.__udivdi3
mov edx, dword [ebp + 0x14]
mov dword [0x40903c], esi
lea eax, [edx + eax*2]
mov dword [0x409038], eax
call sym._GetCurrentProcess_0
mov edi, eax
call sym._GetCurrentThread_0
mov esi, eax
call sym._GetCurrentProcess_0
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._DuplicateHandle_28
sub esp, 0x1c
test eax, eax
je 0x401ae5
lea eax, [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], sym._profthr_func_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [ebx + 4], eax
mov dword [esp + 4], 0xf
mov dword [esp], eax
call sym._SetThreadPriority_8
mov eax, dword [ebx + 4]
sub esp, 8
test eax, eax
je 0x401afa
xor eax, eax
jmp 0x4019b3
call sym.__errno
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x4019b3
call sym.__errno
mov dword [eax], 3
mov eax, 0xffffffff
jmp 0x4019b3
mov eax, dword [ebx]
mov dword [esp], eax
call sym._CloseHandle_4
mov dword [ebx], 0
sub esp, 4
call sym.__errno
mov dword [eax], 0xb
mov eax, 0xffffffff
jmp 0x4019b3

Function at 0x401b60
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov dword [esp], eax
mov dword [ebp - 8], ebx
mov ebx, 0xffffffff
mov dword [ebp - 4], esi
mov esi, eax
call sym._SuspendThread_4
sub esp, 4
cmp eax, 0xffffffff
je 0x401bbb
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 0x10003
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._GetThreadContext_8
sub esp, 8
cmp eax, 1
sbb ebx, ebx
mov dword [esp], esi
or ebx, dword [ebp - 0x21c]
call sym._ResumeThread_4
sub esp, 4
mov eax, ebx
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x401d00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401d26
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401dba
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401d75
cmp eax, 0x40
je 0x401d75
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401d19
cmp eax, 0x40
je 0x401d19
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401d19
mov dword [esp + 8], 0x34
mov dword [esp + 4], 0x40806c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]