joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4169cf
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x416a8c
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x416a53
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x416a3f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x416a3d
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x416a51
push 0x49a
push 0x70d
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x416a87
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
push 0
push dword [ebp - 0x2c]
push 0xd9e
push 0x588a
push 1
push 0x710c
push 1
push 0x66b6
push dword [ebp - 0x30]
call fcn.0041412b
add esp, 0x24
jmp 0x416b21
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x416aff
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x416ad6
push 0x103a
push 0
push 0
push 0xf3f
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x416afd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x416afd
push 0x19bc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x416b21
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
push 0
push dword [ebp - 0x48]
push 1
push 0
push 1
push dword [ebp - 0x4c]
call fcn.0040f2cb
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x418470
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41850c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4184b4
push 0x5ecd
push 0x3386
push 1
call fcn.00418539
add esp, 0xc
jmp 0x41850a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4184e3
mov byte [ebp - 1], 0
push 0x4f07
lea eax, [ebp - 1]
push eax
push 0
call fcn.004187f0
add esp, 0xc
jmp 0x41850a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41850a
push 0x113f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x418535
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
push 0
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0040b87e
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x42426c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42431d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4242ba
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
call fcn.00424347
pop ecx
pop ecx
jmp 0x42431b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4242ff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4242fd
push 0
push 0x1af8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x42431b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x42431b
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x424343
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 1
push dword [ebp - 0x3c]
push 0x52bf
push 0x554e
call fcn.00412721
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x429a92
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x429b79
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x429ae9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push 0x562a
push dword [ebp - 0x10]
call fcn.00429bae
add esp, 0xc
jmp 0x429b77
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x429b54
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 2
jmp 0x429b27
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x429b52
push 1
push 1
push 0x34ab
push 0x2b74
push 0x1481
push 1
push 0
push 0
call fcn.00423237
add esp, 0x20
jmp 0x429b1c
jmp 0x429b77
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x429b77
push 0xc25
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x429baa
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
push 0x1748
push 0x6715
push 0xc02
push 0x5d23
push 1
push 0x1bfb
push dword [ebp - 0x38]
push 0x37ff
call fcn.00411314
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x42d38a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x42d404
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x7a20
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x167e
push 0x64b9
push dword [ebp - 0x1c]
push 1
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x24]
call fcn.0042d52d
add esp, 0x34
jmp 0x42d529
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x42d4da
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x42d4b7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x42d48c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x42d4b5
push 0
push 0x72cc
push dword [ebp - 0x50]
push 0x2540
push dword [ebp - 4]
push 0x2002
call fcn.0042cd13
add esp, 0x18
jmp 0x42d481
jmp 0x42d4d8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x42d4d8
push 0x827
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x42d529
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
push 0x57db
push 0x6337
push 0x6ed9
push 0x7214
push 0x5820
push 0x3e22
push 0x2b3b
push dword [ebp - 0x68]
push 1
push 1
push 0x9d1
push dword [ebp - 0x6c]
push 1
push 1
push 0x1544
call fcn.00427bfd
add esp, 0x3c
mov esp, ebp
pop ebp
ret
Function at 0x42efb8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42f12d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42f06d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42f060
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42f05e
push 0x3d87
push 0x31a5
push 0x5676
push 0xe3e
push 1
push 1
push 0x18d2
push 1
push 1
push 0x5d96
call fcn.0042b98b
add esp, 0x28
jmp 0x42f068
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x42f12b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x42f0df
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x42f0c3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x42f0dd
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.00435532
and dword [eax], 0
jmp 0x42f0b8
jmp 0x42f12b
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x42f10d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x42f12b
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x64]
call fcn.00435532
cmp dword [eax], 0
je 0x42f129
jmp 0x42f12b
jmp 0x42f102
jmp 0x42f173
lea eax, [ebp + 0x14]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
test eax, eax
je 0x42f153
push 1
push 0x711d
push 0x299d
call fcn.00411870
add esp, 0xc
jmp 0x42f173
push 0x46a9
push 0x749d
push 0
push 1
push 0x3a79
push 0xc56
call fcn.0041058b
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x42f177
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42f1c1
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
call fcn.0042f251
add esp, 0x18
jmp 0x42f24d
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42f1f3
push 1
push 0x4539
call fcn.0040c17a
pop ecx
pop ecx
jmp 0x42f24d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x42f238
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x42f236
push 0
push 0x729
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x42f24d
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], 0xfffffff8
mov esp, ebp
pop ebp
ret
Function at 0x43cdbe
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x43cde6
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
call fcn.0043cf33
pop ecx
pop ecx
jmp 0x43cf2f
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43ced8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43ce8b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43ce89
push 0x247f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x43ced6
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43ceb9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x43ced6
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.00435532
mov dword [eax], 1
jmp 0x43ceae
jmp 0x43cf2f
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push 0x4d6c
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push 0
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call fcn.00444a21
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x43dc88
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x43dd47
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43dcfc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43dce3
push 0
push 0x1afd
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x43dcfa
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43dd45
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0x70af
push dword [ebp - 0x24]
push 0
push 0x1d09
push 0x432
push 0x4d18
push 0x56f5
push 0x416
push 1
push 0x5bd2
push 0x4e8
push 0x7996
push 0x2271
push 0
call fcn.0043ea47
add esp, 0x38
jmp 0x43ddaa
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43dd88
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x43dd7e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
jmp 0x43dd86
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x43ddaa
push 1
push 0x66e1
push 0
push 1
push 0x7d89
push 0x1578
push 0x723b
call fcn.0043e1f2
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x43e010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43e118
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43e0e2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43e0bd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43e09e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x43e0bb
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00435532
mov dword [eax], 0x65786371
jmp 0x43e093
jmp 0x43e0e0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x43e0e0
push 0
push 0xca3
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x43e116
push 0
push 0x1f24
push 0x43b5
push 0x6c9c
push 1
push 0x5287
push 0x112f
push 0x6e9b
push 0x3e7e
push 0xa4e
call fcn.0044dfd9
add esp, 0x28
jmp 0x43e138
lea eax, [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
push 0
push dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
push eax
call fcn.0044a689
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x43e56b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x43e5d0
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43e5bd
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
push dword [ebp - 0x10]
push 0x266
push 0x2b9a
push dword [ebp - 0x14]
call fcn.004512df
add esp, 0x14
jmp 0x43e5cb
push 0
push 0xa7
call fcn.00459184
pop ecx
pop ecx
jmp 0x43e676
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43e647
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43e633
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x43e631
push 0
push 0xca3
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x43e645
push 0
push 0x1f37
push 0x523
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
jmp 0x43e676
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 0x5062
push dword [ebp - 0x3c]
push 0x3863
push 0
push 0x3aba
push 1
push 1
push dword [ebp - 0x40]
call fcn.0043dacc
add esp, 0x20
mov esp, ebp
pop ebp
ret