joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023170
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.10010700
lea ecx, [ebp - 4]
call fcn.10023140
movzx eax, al
test eax, eax
jne 0x100231ad
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.10023080
mov eax, dword [ebp - 0x18]
jmp 0x100232d5
lea ecx, [ebp - 4]
call fcn.1000d550
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10023100
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.1000d550
push eax
push 0
push 0
call fcn.10022fc0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10023213
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.10023080
mov eax, dword [ebp - 0x20]
jmp 0x100232d5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1000ff90
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.10008900
lea ecx, [ebp - 8]
call fcn.10008940
movzx edx, al
test edx, edx
jne 0x1002325c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.10008e40
lea ecx, [ebp - 4]
call fcn.10023080
mov eax, dword [ebp - 0x24]
jmp 0x100232d5
lea ecx, [ebp - 8]
call fcn.10008990
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.1000d550
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.10022fc0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100232b7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.10008e40
lea ecx, [ebp - 4]
call fcn.10023080
mov eax, dword [ebp - 0x34]
jmp 0x100232d5
lea ecx, [ebp - 8]
call fcn.100113b0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.10008e40
lea ecx, [ebp - 4]
call fcn.10023080
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret

Function at 0x10023aa0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100233a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10023ad4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10038144]
call dword [ebp - 8]
jmp 0x10023ada
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10023b30
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100233e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10023b64
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10038144]
call dword [ebp - 8]
jmp 0x10023b6e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x10023b80
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10023400
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10023bb8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x10038144]
call dword [ebp - 8]
jmp 0x10023bc6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8
Function at 0x100301e0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10036a30
mov eax, dword [0x10047004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10048280]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x100303b8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x10030307
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x10030307
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x100302e5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x10030269
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10030371
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x100303d8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x100303b3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x100303d8
jmp 0x10030242
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008290
mov esp, ebp
pop ebp
ret
Function at 0x100303f0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10036a30
mov eax, dword [0x10047004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10048280]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x100305db
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10030526
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10030526
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10030502
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x10030479
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10030594
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x100305fb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x100305d6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x100305fb
jmp 0x10030452
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008290
mov esp, ebp
pop ebp
ret
Function at 0x417bc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00417bd7

Function at 0x41a340
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x41e1c0
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.004207e0
call fcn.0041a860
push eax
push dword [ebp - 4]
call fcn.004218a0
mov dword [ebp - 4], eax
push 0x56a70c
push dword [eax]
call fcn.004217a0
add esp, 0x1c
test eax, eax
jne 0x41a394
push 0x1ff
call fcn.0041a860
push eax
call fcn.0053b9d0
add esp, 8
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
call fcn.00423c90
mov eax, dword [ebp - 4]
push 0x5c
push dword [eax]
call fcn.00546389
mov esi, eax
mov byte [esi], 0
mov ecx, dword [ebp - 4]
push dword [ecx]
call fcn.00541ac9
mov byte [esi], 0x5c
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00541ac9
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 0x41e1c0
lea eax, [ebp - 4]
lea esi, [ebp + 4]
push eax
add esi, 0xfffffffc
push esi
call fcn.004207e0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push 0x41e1c0
push eax
push esi
call fcn.004207e0
call fcn.0041a800
push eax
push dword [ebp - 0x18]
call fcn.004218a0
mov ecx, eax
add esp, 0x20
mov eax, dword [0x5fd860]
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x41aa1c
push dword [ecx]
push str._s_luminati
push dword [ebp - 4]
call fcn.00421930
add esp, 0xc
cmp dword [0x5ed010], 0
je 0x41aa07
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00423910
add esp, 4
test eax, eax
jne 0x41aa07
push 0x41e1c0
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.004207e0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push 0x41e1c0
push eax
push esi
call fcn.004207e0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push 0x41e1c0
push eax
push esi
call fcn.004207e0
call fcn.0041a800
push eax
push dword [ebp - 0xc]
call fcn.004218a0
mov ecx, dword [0x5fd85c]
add esp, 0x2c
mov dword [ebp - 0xc], eax
test ecx, ecx
jne 0x41a9ef
push ebx
push edi
mov edi, dword [ebp - 0x10]
push edi
mov dword [ebp - 8], ecx
call fcn.00421a20
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x56a6c0
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x41a9eb
push eax
push dword [ebp - 8]
push eax
call fcn.00541aaf
push eax
call fcn.0053b370
mov ebx, eax
add esp, 0x10
cmp ebx, 0xffffffff
je 0x41a9eb
push ebx
push edi
call fcn.00421a50
push ebx
push dword [ebp - 8]
push dword [edi]
call fcn.00541aaf
push eax
call fcn.0053b370
add esp, 0x18
cmp eax, 0xffffffff
je 0x41a9eb
push edi
call fcn.00423c70
push dword [ebp - 0xc]
call fcn.00423c90
add esp, 8
push dword [eax]
push esi
call fcn.00420c70
add esp, 4
push eax
call fcn.0041e150
push dword [eax]
mov eax, dword [ebp - 0x10]
push dword [eax]
push str._s_BrightData__s
push dword [ebp - 0x14]
call fcn.00421930
mov eax, dword [ebp - 0x14]
add esp, 0x18
mov ecx, dword [eax]
mov dword [0x5fd85c], ecx
mov dword [eax], 0
jmp 0x41a9ed
xor ecx, ecx
pop edi
pop ebx
push ecx
push 0x5fd860
call fcn.004218a0
mov eax, dword [0x5fd860]
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [0x5fd860], eax
mov dword [ecx], 0
mov eax, dword [0x5fd860]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41c650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov dword [0x5fd87c], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x56b8a8
mov edi, eax
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x41c683
xor esi, esi
jmp 0x41c6ab
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41c693
xor esi, esi
jmp 0x41c6ab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41c6ab
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
push esi
call fcn.0053b3a0
add esp, 4
test eax, eax
jne 0x41c6e9
lea eax, [ebp + 4]
sub eax, 4
push 0x56b910
push eax
call fcn.00420b40
push 0
push 0
push 0
push 1
push dword [eax]
push str.dll_failed_loading_mem_res
call fcn.00418b20
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push eax
call fcn.0041f940
push eax
call fcn.0053b3a0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41c72f
lea eax, [ebp + 4]
sub eax, 4
push 0x56b910
push eax
call fcn.00420b40
push esi
push esi
push esi
push 1
push dword [eax]
push str.dll_failed_loading_mem_mod
call fcn.00418b20
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.mem_loaded_sdk_dll_0x_p
push 5
call fcn.00424200
add esp, 0xc
mov dword [0x5fd880], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x41e1c0
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.004207e0
add esp, 0xc
mov dword [ebp - 4], eax
call dword [sym.imp.lum_sdk32.dll__brd_sdk_get_uuid_c_0]
push eax
push 0x56bd6c
push 2
call fcn.00541bde
add esp, 4
push eax
call fcn.0041a7d0
add esp, 0xc
push 0
call fcn.00541795
int3

Function at 0x41e950
Capabilities:
Terminate process

Disassembly:
push dword [0x5f9d2c]
push str.Brightdata_Service
push str.net_updater__OPTIONS_____s__s_n___h___print_this_message_n____updater_appid___run_init_monitor_with_provided_appid._n____install_appid___install_service_with_provided_appid_n____install_ui_appid___install_service_with_provided_appid_after_showing_dialog_and_getting_user_permission_n____check_peer_appid___validate_peer_n____uninstall_appid___remove_service_with_provided_appid__must_match_appid_used_during_install__n____start_service_appid___starts_Bright_Data_service_n____stop_service_appid___stops_Bright_Data_service_n____dlg_pos__ownerscreentop:left__n____dlg_language___language_code_e.g.__de_DE__or__de__n____dlg_bg_color_color___e.g.__ff112233__n____dlg_btn_color_color_n____dlg_txt_color_color_n____dlg_app_name_name_n____dlg_logo_link_logo_n____dlg_benefit_benefit_n____dlg_agree_btn_text_n____dlg_disagree_btn_text_n____campaign_campaign_id___optional_parameter_for_the_further_breakdown_of_the_existing_app_ID_to_monitor_the_statistics_separately_n
push 2
call fcn.00541bde
add esp, 4
push eax
call fcn.0041a7d0
add esp, 0x10
push 1
call fcn.00541795
int3
Function at 0x41eea0
Capabilities:
Terminate process

Disassembly:
push dword [0x5f9d2c]
push 0x56bd6c
push 2
call fcn.00541bde
add esp, 4
push eax
call fcn.0041a7d0
add esp, 0xc
push 0x4d2
call fcn.00541795
int3
Function at 0x4205e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00421950
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x420635
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call fcn.00422230
add esp, 8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 8]
push eax
call fcn.00422200
add esp, 4
push 2
call fcn.00541bde
push eax
push dword [ebp - 4]
call fcn.00547f61
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x420658
push eax
call fcn.005414d0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x422ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, 0x40
push edi
xor edi, edi
cmp esi, eax
cmovle esi, eax
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x422f10
call fcn.005414b2
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
push esi
push ebx
mov dword [ebp + 0x14], eax
call fcn.00421a50
push dword [ebp + 0xc]
lea eax, [esi + 1]
push eax
push 1
push dword [ebx]
call fcn.00541e3c
add esp, 0x18
test eax, eax
jle 0x422f6b
add edi, eax
cmp eax, esi
jle 0x422f6b
add esi, esi
lea eax, [esi + edi]
cmp eax, 0x40000000
jge 0x422f9a
inc eax
push eax
push dword [ebx]
call fcn.00547937
push dword [ebp + 0xc]
lea ecx, [esi + 1]
mov dword [ebx], eax
push ecx
add eax, edi
push 1
push eax
call fcn.00541e3c
add esp, 0x18
test eax, eax
jg 0x422f36
mov esi, dword [ebp + 0x14]
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x422f7d
mov dword [eax], edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x422f8f
call fcn.005414b2
pop edi
mov dword [eax], esi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0x1b
jmp 0x422f6e
Function at 0x423200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push esi
call fcn.00423cd0
push eax
push dword [ebp + 8]
call fcn.00423600
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x42322b
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 0xffffffff
jne 0x423249
mov edi, edx
lea ebx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x423240
sub edi, ebx
push ecx
push edi
push 1
push edx
call fcn.00548884
mov ebx, eax
add esp, 0x10
cmp ebx, edi
je 0x4232f2
push esi
call fcn.00423a90
add esp, 4
test eax, 0x1000
jne 0x4232d1
push esi
call fcn.00423a90
and eax, 0xf
add esp, 4
cmp al, 6
ja 0x4232f2
push esi
call fcn.00423a90
and eax, 0xf
add esp, 4
cmp al, 5
jbe 0x4232d1
push esi
call fcn.00423a90
add esp, 4
test eax, 0x1300
jne 0x4232d1
push esi
call fcn.00423a90
push dword [ebp + 0x14]
mov esi, eax
and esi, 0xc90000
or esi, 0x360000
shr esi, 0x10
call fcn.00423a90
and eax, 0xf
add esp, 8
cmp dword [esi*4 + 0x601b40], eax
jl 0x4232f2
mov esi, dword [ebp + 0x14]
push ebx
push edi
push dword [ebp + 8]
push str.failed_fwrite__s__sz__d__returned__d
push esi
call fcn.00423a90
add esp, 4
or eax, 0x360000
push eax
call fcn.00424200
add esp, 0x14
push dword [ebp - 4]
call fcn.005484a6
add esp, 4
sub ebx, edi
neg ebx
sbb ebx, ebx
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x423390
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x10000
call fcn.005414d5
mov esi, dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
push esi
or edi, 0xffffffff
call fcn.0053c550
add esp, 0xc
test eax, eax
jne 0x423473
push 0x56ea94
push esi
call fcn.0053bdf0
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x423473
push 0x56ec08
push dword [ebp + 0xc]
call fcn.0053bdf0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x423458
mov edi, dword [ebp - 0x2c]
mov ecx, edi
mov ebx, dword [ebp - 0x28]
or ecx, ebx
je 0x42344e
nop
test ebx, ebx
jl 0x423415
jg 0x42340e
cmp edi, 0x10000
jbe 0x423415
mov esi, 0x10000
jmp 0x423417
mov esi, edi
push dword [ebp - 8]
push esi
push 1
push dword [ebp - 4]
call fcn.00541e3c
add esp, 0x10
cmp eax, esi
jne 0x423452
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 4]
call fcn.00548884
add esp, 0x10
cmp eax, esi
jne 0x423452
mov eax, esi
cdq
sub edi, eax
mov eax, edi
sbb ebx, edx
or eax, ebx
jne 0x423400
xor edi, edi
jmp 0x423455
or edi, 0xffffffff
mov ebx, dword [ebp - 4]
push dword [ebp - 8]
call fcn.005484a6
mov eax, dword [ebp - 0xc]
add esp, 4
test eax, eax
je 0x423473
push eax
call fcn.005484a6
add esp, 4
push ebx
call fcn.005414d0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push fcn.00422200
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.004207e0
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [0x5fd8bc]
test eax, eax
jne 0x4238e4
push esi
push str.TEMP
call fcn.0053b460
add esp, 4
test eax, eax
jne 0x42387a
push 0x56ead0
call fcn.0053b460
add esp, 4
test eax, eax
jne 0x42387a
push dword [ebp - 4]
call fcn.00422270
mov eax, dword [ebp - 4]
add esp, 4
push dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x423830
push esi
push dword [ebp - 4]
call fcn.00422290
mov ecx, dword [ebp - 4]
add esp, 8
push dword [ecx]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp - 4]
push dword [eax]
push 0x5fd8bc
call fcn.00421a00
jmp 0x423885
push 0x56ead4
call fcn.0053b460
add esp, 4
test eax, eax
je 0x4238e8
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx*2 + 0x5dfc78], 4
je 0x4238e8
cmp byte [eax + 1], 0x3a
jne 0x4238e8
movsx eax, dl
push eax
push str._c:_Temp
push 0x5fd8bc
call fcn.00421930
add esp, 0xc
jmp 0x423888
push eax
push 0x5fd8bc
call fcn.004218a0
add esp, 8
lea eax, [ebp - 0x3c]
push eax
push dword [0x5fd8bc]
call fcn.0053c550
add esp, 8
pop esi
test eax, eax
jne 0x4238b3
movzx eax, word [ebp - 0x36]
test eax, eax
je 0x4238b3
and eax, 0xf000
cmp eax, 0x4000
je 0x4238df
push dword [0x5fd8bc]
push str.creating_temp_directory__s
push 0x360004
call fcn.00424200
push 0x1ff
push dword [0x5fd8bc]
call fcn.0053b9d0
add esp, 0x14
test eax, eax
jne 0x4238f7
mov eax, dword [0x5fd8bc]
mov esp, ebp
pop ebp
ret
push str.failed_to_get_temp_directory
push 0x360000
call fcn.00424760
push str.failed_to_create_temp_directory
push 0x360000
call fcn.00424760
int3