joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010c0
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [ebp - 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, eax
cmp edx, 3
jl 0x401102
push str._runtime
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp edx, 5
jl 0x401118
push str._runtime
push dword [esi + 0xc]
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x40118a
push 0x20a
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push str.Adobe_AIRVersions1.0Adobe_AIR.dll
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.00401020
add esp, 8
test al, al
jne 0x401151
mov eax, 4
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40117b
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x40118a
lea eax, [ecx + 3]
pop esi
mov esp, ebp
pop ebp
ret
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
test eax, eax
je 0x401147
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push str.CaptiveAppEntryWinMain
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 8]
mov edx, eax
xor eax, eax
test edx, edx
pop esi
mov dword [ecx], edx
mov ecx, 4
cmove eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x4011e0
Capabilities:
Identify system language via api

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
mov ecx, 0x41478c
xor eax, eax
mov edx, esi
cmp edx, dword [ecx]
je 0x401200
inc eax
add ecx, 0x10
cmp eax, 0x11
jb 0x4011f3
cmp eax, 0x11
jne 0x401237
push edi
xor ecx, ecx
mov edx, 0x41478c
and esi, 0x3ff
mov edi, 0x3ff
nop dword [eax + eax]
mov ax, word [edx]
and ax, di
cmp si, ax
je 0x401234
inc ecx
add edx, 0x10
cmp ecx, 0x10
jb 0x401220
mov eax, ecx
pop edi
pop esi
ret
Function at 0x401250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.SetDllDirectoryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401283
push 0x412740
mov ecx, esi
call dword [0x40c12c]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call fcn.004010c0
mov esi, eax
add esp, 8
test esi, esi
je 0x4012c7
call fcn.004011e0
push 0
push 0x30
push str.Adobe_AIR
mov ecx, eax
call fcn.00401240
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
jmp 0x4012e2
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [ebp - 8]
mov ecx, esi
push eax
call dword [0x40c12c]
call esi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43f9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x56211c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov eax, dword [0x56211c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00409280
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
mov edx, dword [eax]
push 0
push 0
call dword [edx]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 0
mov byte [esp + 8], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 8]
cmp dword [esp + 0x1c], 0x10
lea eax, [esp + 8]
push 0x44f84a
cmovae ecx, dword [esp + 0xc]
add ecx, dword [esp + 0x1c]
cmp dword [esp + 0x20], 0x10
push str.Copying...__p_
cmovae eax, dword [esp + 0x10]
add eax, dword [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.004115f0
mov dword [esp + 0x30], 1
mov ecx, ebx
call fcn.00409280
lea ecx, [esp + 8]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 4]
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x1c], 0x10
jb 0x404939
push dword [esp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, ebx
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 0
mov byte [esp + 8], 0
call fcn.00409280
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 8

Function at 0x404aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x404ab2
mov al, 1
pop ebp
ret 4
cmp dword [eax + 0x14], 8
jb 0x404aba
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret 4
Function at 0x405330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fd6f
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x56211c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
mov dword [ebp - 0x284], 0
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x288], esi
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4054b3
lea eax, [ebp - 0x238]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x280], eax
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], 0
mov word [ebp - 0x238], ax
mov dword [ebp - 4], 3
sub esp, 0x18
mov dword [ebp - 0x220], eax
mov ecx, esp
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x279]
mov dword [ebp - 0x280], esp
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00408e30
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x238]
call fcn.00410020
mov dword [ebp - 4], 5
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.004056e0
mov dword [ebp - 0x284], 1
mov dword [ebp - 4], 0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x280], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x224], 8
jb 0x405478
push dword [ebp - 0x238]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
mov eax, esi
mov dword [ebp - 0x228], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x279]
push eax
push str.FileSystem.cpp_431__:_System::FileSystem::getTempDirectory
call fcn.00408ab0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x230]
push eax
push esi
lea ecx, [ebp - 0x278]
call fcn.0041f420
push 0x55e414
lea eax, [ebp - 0x278]
push eax
call sub.MSVCR120.dll__CxxThrowException
int3
Function at 0x405810
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43ff08
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x56211c]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
mov eax, dword [0x56211c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x4058c6
cmp dword [esi + 0x14], 8
jb 0x405858
mov eax, dword [esi]
jmp 0x40585a
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405870
shr eax, 4
and al, 1
jne 0x4058c6
lea ecx, [ecx]
cmp dword [esi + 0x14], 8
jb 0x405878
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4058c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esp + 0xc]
lea eax, [esp + 0xb]
push eax
push str.FileSystem.cpp_515__:_System::FileSystem::createDirectory
call fcn.00408ab0
mov dword [esp + 0x78], 0
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x2c]
call fcn.0041f420
push 0x55e414
lea eax, [esp + 0x28]
push eax
call sub.MSVCR120.dll__CxxThrowException
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 4
Function at 0x4058f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ff90
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x56211c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x18], 0
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x14], 0
push esi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.0040a850
mov dword [ebp - 4], 1
or edi, 0xffffffff
cmp dword [esi + 0x10], 0
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
je 0x405aaf
cmp dword [esi + 0x14], 8
jb 0x405971
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405988
shr eax, 4
and al, 1
jne 0x405aaf
lea eax, [ebp - 0x48]
mov dword [ebp - 0x64], 0x5c
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x18]
inc edi
cmp eax, edi
ja 0x4059a5
or edi, 0xffffffff
jmp 0x4059d4
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
lea ecx, [ebp - 0x64]
cmovae esi, dword [ebp - 0x28]
sub eax, edi
push ecx
push eax
lea eax, [esi + edi*2]
push eax
call fcn.00403570
mov edi, eax
add esp, 0xc
sub edi, esi
mov eax, 0xffffffff
sar edi, 1
cmp dword [ebp - 0x18], edi
cmove edi, eax
push edi
push 0
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x28]
call fcn.004090e0
mov byte [ebp - 4], 2
xor ecx, ecx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], cx
mov byte [ebp - 4], 4
sub esp, 0x18
mov dword [ebp - 0x30], ecx
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 0x78], ecx
mov word [ecx], dx
call fcn.0040a850
mov byte [ebp - 4], 6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
call fcn.00410020
mov byte [ebp - 4], 7
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x68]
push eax
call fcn.00405810
mov byte [ebp - 4], 2
cmp dword [ebp - 0x34], 8
jb 0x405a6c
push dword [ebp - 0x48]
call ebx
add esp, 4
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x4c], 8
jb 0x405a92
push dword [ebp - 0x60]
call ebx
add esp, 4
xor eax, eax
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x50], 0
mov word [ebp - 0x60], ax
cmp edi, 0xffffffff
jne 0x405998
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x405ac4
push dword [ebp - 0x28]
call ebx
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 4
Function at 0x406000
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440198
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x56211c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x406050
cmp dword [esi + 0x14], 8
jb 0x40603c
mov eax, dword [esi]
jmp 0x40603e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x40609e
nop
cmp dword [esi + 0x14], 8
jb 0x406058
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40609e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x69]
push eax
push str.FileSystem.cpp_621__:_System::FileSystem::deleteFile
call fcn.00408ab0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
push esi
lea ecx, [ebp - 0x68]
call fcn.0041f420
push 0x55e414
lea eax, [ebp - 0x68]
push eax
call sub.MSVCR120.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 4
Function at 0x407780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44088a
mov eax, dword fs:[0]
push eax
sub esp, 0x380
mov eax, dword [0x56211c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x388], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x380], esi
mov dword [ebp - 0x37c], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
je 0x407919
push str.FileSystem.cpp_1259__:_System::FileSystem::getUserDocsDirectory
lea ecx, [ebp - 0x274]
call fcn.00422c20
mov dword [ebp - 4], 1
push str.:_Throwing_::Win32::Exception_static_cast_DWORD__hr___r_n
push str.FileSystem.cpp_1259__:_System::FileSystem::getUserDocsDirectory
push str._s_s
push eax
call fcn.00422d30
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x388], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x260], 0x10
jb 0x40786b
push dword [ebp - 0x274]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x260], 0xf
mov dword [ebp - 0x264], 0
mov byte [ebp - 0x274], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x220], 0xf
mov dword [ebp - 0x224], 0
mov byte [ebp - 0x234], 0
mov dword [ebp - 4], 5
lea eax, [ebp - 0x234]
push eax
push edi
lea ecx, [ebp - 0x2bc]
call fcn.0041f420
mov byte [ebp - 4], 6
mov edx, str.FileSystem.cpp_1259__:_System::FileSystem::getUserDocsDirectory
mov ecx, eax
call fcn.0040d3f0
mov esi, eax
push esi
lea ecx, [ebp - 0x2fc]
call fcn.00403a30
mov byte [ebp - 4], 7
mov dword [ebp - method.Win32::Exception.virtual_0], vtable.Win32::Exception.0
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 4], 6
push 0x55e414
lea eax, [ebp - 0x2fc]
push eax
call sub.MSVCR120.dll__CxxThrowException
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x248], 7
mov dword [ebp - 0x24c], 0
xor eax, eax
mov word [ebp - 0x25c], ax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 0xb
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040c9b0
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x25c]
call fcn.0040cb20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x23c]
call fcn.0040cab0
lea eax, [ebp - 0x25c]
push eax
mov ecx, esi
call fcn.0040c890
mov dword [ebp - 0x37c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.0040cab0
mov eax, esi
jmp 0x407b1f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 4
Function at 0x408130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440a60
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x56211c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
mov dword [ebp - 0x2d4], 0
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x2d8], esi
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
je 0x4082bf
push str.FileSystem.cpp_1435__:_System::FileSystem::getAllUsersAppDataDirectory
lea ecx, [ebp - 0x230]
call fcn.00422c20
mov dword [ebp - 4], 1
push str.:_Throwing_::Win32::Exception_static_cast_DWORD__hr___r_n
push str.FileSystem.cpp_1435__:_System::FileSystem::getAllUsersAppDataDirectory
push str._s_s
push eax
call fcn.00422d30
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 0x230]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x21c], 0x10
jb 0x408211
push dword [ebp - 0x230]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], 0
mov byte [ebp - 0x230], 0
mov dword [ebp - 0x234], 0xf
mov dword [ebp - 0x238], 0
mov byte [ebp - 0x248], 0
mov dword [ebp - 4], 5
lea eax, [ebp - 0x248]
push eax
push edi
lea ecx, [ebp - 0x2c8]
call fcn.0041f420
mov byte [ebp - 4], 6
mov edx, str.FileSystem.cpp_1435__:_System::FileSystem::getAllUsersAppDataDirectory
mov ecx, eax
call fcn.0040d3f0
mov esi, eax
lea ecx, [ebp - 0x288]
push esi
call fcn.00403a30
mov byte [ebp - 4], 7
mov dword [ebp - method.Win32::Exception.virtual_0], vtable.Win32::Exception.0
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x288]
push 0x55e414
push eax
call sub.MSVCR120.dll__CxxThrowException
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x2d0], esi
mov word [esi], ax
mov dword [ebp - 4], 0xa
sub esp, 0x18
mov dword [esi + 0x18], eax
mov ecx, esp
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x2c9]
mov dword [ebp - 0x2d0], esp
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00408e30
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.00410020
mov dword [ebp - 4], 0
mov dword [ebp - 0x2d4], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 4
Function at 0x422540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004225a0

Function at 0x422550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00422810
Function at 0x422810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x444e82
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x56211c]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
push edi
mov eax, dword [0x56211c]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
test edx, edx
jne 0x422863
xor eax, eax
jmp 0x4229ab
mov eax, dword [ecx + 0x24]
cmp eax, 0xffffffff
jne 0x422948
push str...Win32IoHandle.cpp_334__:_Win32::IoHandle::doWrite
lea ecx, [esp + 0x20]
call fcn.00422c20
mov dword [esp + 0xc0], 0
push str.:_Throwing_Lang::Exception__IoHandle_not_open___r_n
push str...Win32IoHandle.cpp_334__:_Win32::IoHandle::doWrite
push str._s_s
push eax
call fcn.00422d30
add esp, 0x10
mov dword [esp + 0xc0], 0xffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc0], 0xffffffff
cmp dword [esp + 0x30], 0x10
jb 0x4228d2
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x13]
mov dword [esp + 0x30], 0xf
push eax
push str.IoHandle_not_open
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00408ab0
mov dword [esp + 0xc0], 3
call fcn.00403900
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
call fcn.00403980
mov byte [esp + 0xc0], 4
push str...Win32IoHandle.cpp_334__:_Win32::IoHandle::doWrite
push eax
call fcn.0040d2d0
add esp, 8
lea ecx, [esp + 0x74]
push eax
call fcn.00403a30
push 0x55e310
lea eax, [esp + 0x78]
push eax
call sub.MSVCR120.dll__CxxThrowException
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4229a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x13]
push eax
push str...Win32IoHandle.cpp_345__:_Win32::IoHandle::doWrite
call fcn.00408ab0
mov dword [esp + 0xc0], 5
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x3c]
call fcn.0041f420
push 0x55e414
lea eax, [esp + 0x38]
push eax
call sub.MSVCR120.dll__CxxThrowException
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42c580
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x56211c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0042dbb0
mov dword [esi], eax
mov ebx, dword [sym.imp.MSVCR120.dll_strcpy_s]
mov dword [ebp - 4], 0
test edi, edi
je 0x42c615
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c5e0
sub ecx, edx
je 0x42c615
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c5f0
sub ecx, edx
lea eax, [ecx + 1]
push eax
mov dword [ebp - 0x24], eax
call sub.MSVCR120.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x42c633
push edi
push dword [ebp - 0x24]
jmp 0x42c62d
push 0x14
call sub.MSVCR120.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x42c633
push str.Unknown_Client_Name
push 0x14
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x10
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x42c65d
lea eax, [ebp - 0x20]
push 0x10
push eax
call dword [sym.imp.MSVCR120.dll__mbslwr_s]
add esp, 8
jmp 0x42c661
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
lea edi, [esi + 0xc]
push 0x10
push edi
call ebx
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c675
sub ecx, edx
jne 0x42c68d
push str.Unknown_Machine_Name
push 0x10
push edi
call ebx
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043babe
mov esp, ebp
pop ebp
ret 4