joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406990
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406bc0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406a13
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406bc0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406a13
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406bdc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406a9c
xor eax, eax
push ebp
push 0x406a95
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004067cc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406a7a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406bfc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406a7a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a9c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406bb6
cmp byte [ebp - 0xd], 0
jne 0x406ae3
cmp byte [ebp - 0x12], 0
je 0x406bb6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406afc
dec ebx
cmp byte [ebx], 0x2e
je 0x406b0b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406afb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406bb6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406b48
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406bb6
cmp byte [ebp - 0xd], 0
je 0x406bb6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406bb6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409034
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x409086
test eax, edx
je 0x409089
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x409049
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40906f
add ecx, 4
js 0x40905f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40906c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x409095
test edx, edx
jne 0x40903c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40999c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0040557c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4099ba
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x4099db
cmp ebx, 3
je 0x4099db
cmp ebx, 0x7b
je 0x4099db
mov eax, esi
call fcn.0040995c
test al, al
jne 0x4099df
xor eax, eax
jmp 0x4099e1
mov al, 1
pop esi
pop ebx
ret

Function at 0x4099e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040557c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4099fd
test al, 0x10
jne 0x409a01
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409b00
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040557c
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x409b14
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.0040557c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409b36
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c9c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c9f9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004051c0
jmp 0x40ca02
mov eax, ebx
mov edx, esi
call fcn.00405124
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ca0c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ca2e
movzx eax, byte [esp]
jmp 0x40ca30
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40d0c0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40cf38
mov eax, dword [0x490670]
cmp byte [eax], 0
je 0x40d13c
mov eax, dword [0x490460]
call fcn.00403740
call fcn.00403040
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a048
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d184
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d172
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x49041c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4937f8]
call fcn.00406774
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x41d624
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041d360
dec esi
jne 0x41d646
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x4224c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42262a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405168
mov eax, dword [ebp - 4]
call fcn.00422244
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x422512
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00405624
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004226c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4225e7
xor eax, eax
push ebp
push 0x4225e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00422398
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00422658
test al, al
je 0x4225be
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004051c0
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4225be
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040557c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4225b8
mov eax, dword [ebp - 8]
call fcn.0040557c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004052c8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004224c0
dec ebx
cmp ebx, 0xffffffff
jne 0x422571
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4225e7
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00422398
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.0040557c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00422384
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422631
lea eax, [ebp - 0x3c]
call fcn.004050d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050f4
ret
Function at 0x4225e7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42262a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405168
mov eax, dword [ebp - 4]
call fcn.00422244
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x422512
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00405624
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004226c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4225e7
xor eax, eax
push ebp
push 0x4225e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00422398
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00422658
test al, al
je 0x4225be
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004051c0
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4225be
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040557c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4225b8
mov eax, dword [ebp - 8]
call fcn.0040557c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004052c8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004224c0
dec ebx
cmp ebx, 0xffffffff
jne 0x422571
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4225e7
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00422398
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.0040557c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00422384
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422631
lea eax, [ebp - 0x3c]
call fcn.004050d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050f4
ret

Function at 0x422658
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004039a8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x490774]
cmp byte [edx + 0xc], 0
je 0x4226bc
mov edx, dword [0x49076c]
cmp dword [edx], 2
jne 0x4226bc
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x423a4c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 8]
push eax
push 0x20
call fcn.0041e4a4
push eax
call fcn.0041f04c
xor eax, eax
push ebp
push 0x423a9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x423ab4
mov eax, dword [ebp - 8]
call fcn.004239b4
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423aa1
mov eax, dword [ebp - 8]
push eax
call fcn.0041e718
ret

Function at 0x42755c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x4275f4
push 0
mov eax, ebx
call fcn.0040557c
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4275cf
mov ebx, esi
test ebx, ebx
je 0x4275a5
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, esi
call fcn.0040557c
push eax
push 1
push 0
mov eax, edi
call fcn.0040557c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x4275ea
mov ecx, dword [0x49047c]
mov dl, 1
mov eax, dword [0x425c5c]
call fcn.0040d244
call fcn.00404a48
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x428eb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0040556c
xor eax, eax
push ebp
push 0x428f83
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x428f5b
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x428f0e
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00409194
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00405168
mov ecx, 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x428f1f
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x428f4e
mov esi, 1
imul eax, ecx, 0x5517e877
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + esi - 1]
xor ecx, dword [eax*4 + 0x48cbf0]
inc esi
dec ebx
jne 0x428f2a
mov dword [ebp - 0x10], ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x428f65
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428f8a
lea eax, [ebp - 0x14]
call fcn.004050d0
lea eax, [ebp - 0xc]
call fcn.004050d0
ret
Function at 0x428f94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040556c
xor eax, eax
push ebp
push 0x429094
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push ebp
push 0x42906c
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x428ff3
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00409194
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00405168
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x42900d
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x429056
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00406290
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x48cff4]
mov eax, dword [eax*8 + 0x48cff0]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x429018
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x429076
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42909b
lea eax, [ebp - 0x1c]
call fcn.004050d0
lea eax, [ebp - 4]
call fcn.004050d0
ret

Function at 0x429c20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x429ce8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004050d0
xor eax, eax
push ebp
push 0x429cc2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.0040557c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov ebx, eax
test ebx, ebx
jle 0x429cb8
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x429bf8]
call fcn.00406688
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.0040557c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x429ca0
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004052c8
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x429bf8]
call fcn.00406688
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x429ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429cef
lea eax, [ebp - 4]
mov edx, dword [0x429bf8]
call fcn.00406694
ret
Function at 0x42a44c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004050d0
xor edx, edx
push ebp
push 0x42a4d8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x201]
push eax
push 0
push 0
push esi
push 0
call fcn.00429d70
test eax, 0x80000000
sete al
test al, al
je 0x42a4ce
mov edx, ebx
lea eax, [ebp - 0x201]
call fcn.0040a1e8
cmp dword [ebx], 0
je 0x42a4ce
mov eax, dword [ebx]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x42a4b9
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x42a4ce
mov eax, ebx
mov edx, 0x42a4f4
call fcn.004053b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42a4e2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ab58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42acd5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x42acad
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0042482c
cmp al, 9
jb 0x42ac3b
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.0040580c
xor edx, edx
push ebp
push 0x42ac34
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.0040557c
push eax
push 0
push 0
push 0x23
push 0
call fcn.00429d70
test eax, eax
jne 0x42ac1c
mov eax, dword [ebp - 4]
call fcn.0040557c
mov edx, dword [ebp - 8]
call fcn.0040a1e8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42abee
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x42ac0a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040deb4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00405124
call fcn.00404af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42acb7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ac3b
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040580c
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x49046c]
mov eax, dword [eax]
mov ecx, 0x42acec
mov edx, 0x42ad04
call fcn.004231e4
test al, al
je 0x42aca3
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42ac6f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x42aca3
mov eax, dword [ebp - 8]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42ac87
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
je 0x42aca3
mov eax, dword [ebp - 8]
mov edx, 0x42ad50
call fcn.004053b8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42acb7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42acdc
lea eax, [ebp - 0x10]
call fcn.004050d0
lea eax, [ebp - 4]
call fcn.004050d0
ret
Function at 0x42ad54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42aeea
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x42aebd
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0042482c
cmp al, 9
jb 0x42ae33
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.0040580c
xor edx, edx
push ebp
push 0x42ae2c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.0040557c
push eax
push 0
push 0
push 0x1a
push 0
call fcn.00429d70
test eax, eax
jne 0x42ae14
mov eax, dword [ebp - 4]
call fcn.0040557c
mov edx, dword [ebp - 8]
call fcn.0040a1e8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42ade6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x42ae02
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040deb4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00405124
call fcn.00404af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42aec7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ae33
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040580c
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x490520]
mov eax, dword [eax]
mov ecx, 0x42af00
mov edx, 0x42af10
call fcn.004231e4
test al, al
je 0x42aeb3
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00429f10
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00405124
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42ae7f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x42aeb3
mov eax, dword [ebp - 8]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42ae97
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
je 0x42aeb3
mov eax, dword [ebp - 8]
mov edx, 0x42af5c
call fcn.004053b8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42aec7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42aef1
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004050f4
lea eax, [ebp - 4]
call fcn.004050d0
ret