joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44df20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x120
mov edi, dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x3b
xor eax, eax
cmp ebx, 0x104
lea ebx, [ebp - 0x110]
setbe al
mov dword [esp + 4], 0x594e3f
mov dword [esp], eax
call fcn.0044df00
mov dword [ebp - 0x110], 0x6f6f66
mov dword [esp], ebx
mov dword [esp + 4], 1
call edi
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x3f
mov eax, dword [sym.imp.kernel32.dll_lstrcmpA]
mov dword [esp], ebx
mov dword [esp + 4], 0x594e59
mov dword [ebp - 0x114], eax
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], 0x594e5d
movzx eax, al
mov dword [esp], eax
call fcn.0044df00
lea edx, [esi - 1]
mov dword [ebp - 0x110], 0x6f6f66
mov dword [esp + 4], edx
mov dword [ebp - 0x11c], edx
mov dword [esp], ebx
call edi
sub esp, 8
mov dword [ebp - 0x118], eax
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x43
mov dword [esp], ebx
mov dword [esp + 4], 0x594e59
mov eax, dword [ebp - 0x114]
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], 0x594e5d
movzx eax, al
mov dword [esp], eax
call fcn.0044df00
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x44
xor eax, eax
mov dword [esp + 0xc], esi
mov ecx, dword [ebp - 0x118]
mov dword [esp + 4], str.GetWindowsDirectoryW_returned__d__expected__d_n
cmp esi, ecx
mov dword [esp + 8], ecx
sete al
mov dword [esp], eax
call fcn.0044df00
mov dword [ebp - 0x110], 0x6f6f66
mov dword [esp + 4], esi
mov dword [esp], ebx
call edi
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x49
mov dword [esp], ebx
mov dword [esp + 4], 0x594e59
mov eax, dword [ebp - 0x114]
call eax
sub esp, 8
test eax, eax
setne al
mov dword [esp + 4], 0x594eab
movzx eax, al
mov dword [esp], eax
call fcn.0044df00
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x4a
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strlen]
mov dword [esp + 4], 0x594ec4
cmp eax, esi
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0044df00
call fcn.0057d110
mov edx, dword [ebp - 0x11c]
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x4b
xor eax, eax
cmp edx, esi
sete al
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.GetWindowsDirectoryA_returned__d__expected__d_n
mov dword [esp], eax
call fcn.0044df00
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x44e150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x110]
push ebx
sub esp, 0x120
mov edi, dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x7b
xor eax, eax
cmp ebx, 0x104
setbe al
mov dword [esp + 4], 0x594e3f
mov dword [esp], eax
call fcn.0044df00
mov dword [ebp - 0x110], 0x6f6f66
mov dword [esp], esi
mov dword [esp + 4], 1
call edi
sub esp, 8
mov dword [ebp - 0x118], eax
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x7f
mov eax, dword [sym.imp.kernel32.dll_lstrcmpA]
mov dword [esp], esi
mov dword [esp + 4], 0x594e59
mov dword [ebp - 0x114], eax
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], 0x594e5d
movzx eax, al
mov dword [esp], eax
call fcn.0044df00
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], pe_nt_image_headers32
xor eax, eax
mov dword [esp + 0xc], ebx
mov edx, dword [ebp - 0x118]
mov dword [esp + 4], str.GetSystemDirectoryA_returned__d__expected__d_n
cmp ebx, edx
mov dword [esp + 8], edx
sete al
mov dword [esp], eax
call fcn.0044df00
lea edx, [ebx - 1]
mov dword [ebp - 0x110], 0x6f6f66
mov dword [esp + 4], edx
mov dword [ebp - 0x11c], edx
mov dword [esp], esi
call edi
sub esp, 8
mov dword [ebp - 0x118], eax
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x85
mov dword [esp], esi
mov dword [esp + 4], 0x594e59
mov eax, dword [ebp - 0x114]
call eax
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], 0x594e5d
movzx eax, al
mov dword [esp], eax
call fcn.0044df00
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x86
xor eax, eax
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp - 0x118]
mov dword [esp + 4], str.GetSystemDirectoryA_returned__d__expected__d_n
cmp ebx, ecx
mov dword [esp + 8], ecx
sete al
mov dword [esp], eax
call fcn.0044df00
mov dword [ebp - 0x110], 0x6f6f66
mov dword [esp + 4], ebx
mov dword [esp], esi
call edi
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x8b
mov dword [esp], esi
mov dword [esp + 4], 0x594e59
mov eax, dword [ebp - 0x114]
call eax
sub esp, 8
test eax, eax
setne al
mov dword [esp + 4], 0x594eab
movzx eax, al
mov dword [esp], eax
call fcn.0044df00
call fcn.0057d110
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x8c
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strlen]
mov dword [esp + 4], 0x594ec4
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0044df00
call fcn.0057d110
mov edx, dword [ebp - 0x11c]
mov dword [eax], 0x594e33
mov dword [eax + 4], 0x8d
xor eax, eax
cmp edx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.GetSystemDirectoryW_returned__d__expected__d_n
mov dword [esp], eax
call fcn.0044df00
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x453380
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x20]
mov esi, eax
push ebx
mov ebx, ecx
sub esp, 0x24
mov dword [esp + 8], 0x14
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x24], eax
sub esp, 0xc
test ebx, ebx
je 0x453438
call fcn.0057d110
mov dword [eax + 4], esi
mov dword [eax], 0x595e93
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strlen]
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], 0x595e9d
cmp eax, edx
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00453360
call fcn.0057d110
mov dword [eax + 4], esi
mov dword [eax], 0x595e93
mov eax, edi
call fcn.00452760
mov dword [esp + 4], ebx
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_strcmp]
mov dword [esp + 8], esi
test eax, eax
mov dword [esp + 4], 0x595ead
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00453360
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax + 4], esi
mov dword [eax], 0x595e93
mov edx, dword [ebp - 0x24]
xor eax, eax
mov dword [esp + 4], 0x595e9d
test edx, edx
mov dword [esp + 8], edx
sete al
mov dword [esp], eax
call fcn.00453360
call fcn.0057d110
mov dword [eax + 4], esi
mov dword [eax], 0x595e93
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov dword [esp + 4], 0x595ebd
mov dword [esp + 8], edx
cmp dword [eax + 0x34], 0xcb
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00453360
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4544b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x81c
mov eax, dword [0x747ca4]
test eax, eax
je 0x454698
lea eax, [ebp - 0x810]
mov dword [esp + 4], 8
lea esi, [ebp - 0x80c]
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.advapi32.dll_OpenProcessToken]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x47
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.Failed_to_open_token__error__lu_n
mov dword [esp + 8], eax
call fcn.00453360
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x810]
mov dword [esp], eax
call dword [0x747ca4]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x4a
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.Failed_to_get_user_profile_dir__error__lu_n
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00453360
test ebx, ebx
jne 0x4545e8
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x56
mov dword [esp], str.Skipping_USERPROFILE_check__cant_get_user_profile_dir_n
call fcn.00452dc0
mov eax, dword [ebp - 0x810]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x58
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.Failed_to_close_token__error__lu_n
mov dword [esp + 8], eax
call fcn.00453360
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x40c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], str.USERPROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
sub esp, 0xc
mov dword [ebp - 0x818], eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x4e
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.Failed_to_retrieve_environment_variable_USERPROFILE__error__lu_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x818]
sub eax, 1
cmp eax, 0x3ff
setbe al
movzx eax, al
mov dword [esp], eax
call fcn.00453360
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x51
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strcmp]
mov dword [esp + 0xc], esi
test eax, eax
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.USERPROFILE_env_var__s_doesnt_match_GetUserProfileDirectory__s_n
movzx eax, al
mov dword [esp], eax
call fcn.00453360
jmp 0x45459a
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x43
mov dword [esp], str.Skipping_USERPROFILE_check_n
call fcn.00452dc0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x457740
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x11
mov ebp, esp
push edi
push ebx
lea edi, [ebp - 0x150]
lea ebx, [ebp - 0x10c]
sub esp, 0x184
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x164]
mov dword [esp], eax
call fcn.0057d960
mov eax, dword [ebp - 0x164]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], edx
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s_fls_exit_deadlock
call fcn.00456df0
lea eax, [ebp - 0x160]
mov dword [esp + 4], ebx
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x150]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x596dd7
mov dword [eax + 4], 0x428
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.failed_to_create_child__error__lu_n
mov dword [esp + 8], eax
call fcn.00457590
mov dword [esp + 4], 0x3e8
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x596dd7
mov dword [eax + 4], 0x42a
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 4], str.wait_failed_n
mov dword [esp], eax
call fcn.00457590
mov eax, dword [ebp - 0x160]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x15c]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x45b4c0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x20
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x76d020
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x45b690
mov dword [esp + 8], 0x160
mov esi, eax
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, 0xb8
mov ecx, 0x40
mov dword [eax], 0x405a4d
mov ebx, eax
mov eax, 1
sub esp, 0xc
mov word [ebx + 4], ax
lea eax, [ebp - 0x10]
mov word [ebx + 0x10], dx
mov word [ebx + 0x18], cx
mov dword [ebx + 8], 4
mov dword [ebx + 0xc], 0xffff
mov dword [ebx + 0x3c], 0x40
mov dword [ebx + 0x40], 0x4550
mov dword [ebx + 0x44], 0x1014c
mov dword [ebx + 0x54], 0x200200e0
mov dword [ebx + 0x58], 0x1010b
mov dword [ebx + 0x74], 0x10000000
mov dword [ebx + 0x78], 0x1000
mov dword [ebx + 0x7c], 0x1000
mov dword [ebx + 0x80], 1
mov dword [ebx + 0x84], 1
mov dword [ebx + 0x88], 4
mov dword [ebx + 0x90], 0x2000
mov dword [ebx + 0x94], 0x160
mov dword [ebx + 0x9c], 0x1400002
mov dword [ebx + 0xb4], 0x10
mov dword [ebx + 0x138], 0x646f722e
mov dword [ebx + 0x13c], 0x617461
mov dword [ebx + 0x140], 0x1000
mov dword [ebx + 0x144], 0x1000
mov dword [ebx + 0x148], 0
mov dword [ebx + 0x14c], 0
mov dword [ebx + 0x15c], 0xc0000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x160
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov edi, eax
test eax, eax
jne 0x45b6a0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
cmp dword [ebp - 0x10], 0x160
sete al
mov edi, eax
jmp 0x45b660
Function at 0x45bf80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x228]
push ebx
sub esp, 0x338
mov dword [esp + 4], 0x10e
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x72c
xor eax, eax
cmp ebx, 0x10d
setbe al
mov dword [esp + 4], 0x597efc
mov dword [esp], eax
call fcn.0045bef0
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x72d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], 0x597f1c
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0045bef0
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strlen]
cmp eax, 3
je 0x45c022
mov edx, 0x5c
mov word [esi + eax], dx
movzx eax, word [ebp - 0x228]
lea ebx, [ebp - 0x32c]
mov byte [ebp - 0x32e], 0
mov edi, dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov word [ebp - 0x330], ax
lea eax, [ebp - 0x330]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x597f3c
mov dword [esp], eax
call edi
sub esp, 0x10
mov dword [ebp - 0x334], eax
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x73a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.GetTempFileNameA:_error__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x334]
xor eax, eax
test edx, edx
setne al
mov dword [esp], eax
call fcn.0045bef0
call fcn.0057d110
movsx ecx, byte [ebp - 0x330]
xor edx, edx
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x73b
cmp cl, byte [ebp - 0x32c]
je 0x45c1b8
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str.GetTempFileNameA:_first_three_characters_should_be__c:__string_was_actually__s_n
call fcn.0045bef0
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x597f3c
call edi
sub esp, 0x10
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x740
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.GetTempFileNameA:_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0045bef0
mov dword [esp + 4], esi
lea esi, [ebp - 0x11a]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call sub.msvcrt.dll_strlen
add eax, esi
mov dword [eax], 0x32636261
mov dword [eax + 4], 0x706d742e
mov byte [eax + 8], 0
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x744
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_lstrcmpiA]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], esi
movzx eax, al
mov dword [esp + 8], ebx
mov dword [esp + 4], str.GetTempFileNameA:_Unexpected_output___s__vs___s__n
mov dword [esp], eax
call fcn.0045bef0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [ebp - 0x32b], 0x3a
jne 0x45c0ce
xor edx, edx
cmp byte [ebp - 0x32a], 0x5c
sete dl
jmp 0x45c0ce
Function at 0x45f230
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x624]
push ebx
sub esp, 0x62c
mov dword [esp + 4], esi
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
sub esp, 8
mov ebx, eax
test eax, eax
jne 0x45f26c
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x78
je 0x45f480
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x88c
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GetTempPathW_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0045bef0
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x88d
xor eax, eax
cmp ebx, 0x103
setbe al
mov dword [esp + 4], 0x59813c
mov dword [esp], eax
call fcn.0045bef0
mov ecx, dword [sym.imp.kernel32.dll_GetTempFileNameW]
mov dword [esp], esi
lea eax, [ebp - 0x41c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x59ea78
mov dword [ebp - 0x628], ecx
call ecx
sub esp, 0x10
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x890
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GetTempFileNameW_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
lea ebx, [ebp - 0x214]
setne al
mov dword [esp], eax
call fcn.0045bef0
mov dword [esp], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x59ea78
mov ecx, dword [ebp - 0x628]
call ecx
sub esp, 0x10
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x893
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.GetTempFileNameW_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0045bef0
lea eax, [ebp - 0x41c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MoveFileW]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x896
xor eax, eax
mov ecx, dword [edi + 0x34]
test esi, esi
je 0x45f468
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], str.MoveFileW:_unexpected_error__ld_n
mov edi, dword fs:[0x18]
call fcn.0045bef0
mov edx, dword [sym.imp.kernel32.dll_DeleteFileW]
lea eax, [ebp - 0x41c]
mov dword [esp], eax
mov dword [ebp - 0x628], edx
call edx
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x89a
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.DeleteFileW:_error__ld_n
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.0045bef0
mov dword [esp], ebx
mov edx, dword [ebp - 0x628]
call edx
sub esp, 4
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x597dfd
mov dword [eax + 4], 0x89c
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.DeleteFileW:_error__ld_n
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0045bef0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
cmp ecx, 0xb7
sete al
jmp 0x45f3c1
mov eax, 0x889
call fcn.0045b740
mov dword [esp], str.GetTempPathW_is_not_available_n
call fcn.0045bec0
jmp 0x45f45a
Function at 0x4a1850
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
mov eax, edx
push ebx
mov edx, dword fs:[0x18]
sub esp, 0x20
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x14], 0
mov ecx, dword [edx + 0xc]
mov ebx, dword [ecx + 0xc]
lea edi, [ecx + 0xc]
cmp edi, ebx
je 0x4a197e
neg eax
mov dword [ebp - 0x18], eax
jmp 0x4a1929
cmp dword [ebx + 0x18], esi
je 0x4a19b0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x834
movsx eax, word [ebx + 0x3a]
mov ecx, dword [ebx + 0x30]
mov dword [ebp - 0x10], eax
mov edx, eax
test ecx, ecx
je 0x4a1a30
mov eax, ecx
shr eax, 0x10
je 0x4a1a00
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
test eax, eax
jne 0x4a1a20
mov edx, 0xffffffff
mov eax, ecx
call fcn.0049f230
movzx edx, word [ebx + 0x3a]
add edx, 1
mov ecx, dword [ebp - 0x10]
mov dword [esp + 8], eax
xor eax, eax
cmp dx, 1
mov dword [esp + 4], str._s_TlsIndex:__d_n
setbe al
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call fcn.0049fda0
mov ebx, dword [ebx]
cmp edi, ebx
je 0x4a197e
mov eax, dword [ebx + 0x30]
mov dword [esp], 0x5d3b52
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x4a1890
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x82a
movsx edx, word [ebx + 0x3a]
mov dword [esp + 4], str.ntdll.dll_TlsIndex:__d_instead_of_0_n
test dx, dx
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov ebx, dword [ebx]
cmp edi, ebx
jne 0x4a1929
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x838
mov dword [esp + 8], esi
mov dword [esp + 4], str.Couldnt_find_dll__p_in_module_list_n
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0049fda0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax], 0x5d3477
mov ecx, dword [ebp - 0x18]
mov dword [eax + 4], 0x82f
movsx edx, word [ebx + 0x3a]
mov dword [esp + 0xc], ecx
cmp dx, cx
mov dword [esp + 8], edx
sete al
mov dword [esp + 4], str.Test_exe_TlsIndex:__d_instead_of__d_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [ebp - 0x14], 1
jmp 0x4a1923
movzx ecx, cx
mov dword [esp], 0x5d3480
mov dword [esp + 4], ecx
call fcn.0049f460
movzx edx, word [ebx + 0x3a]
jmp 0x4a18fc
movzx edx, word [ebx + 0x3a]
mov eax, 0x5d3486
jmp 0x4a18fc
mov eax, 0x5d3b4b
jmp 0x4a18fc
Function at 0x4dfcb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x89
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], 0x5e66fc
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp], eax
call fcn.004df840
lea eax, [ebp - 8]
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x160
mov dword [esp + 4], 0x5e80c0
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2000
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SetEndOfFile]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret