joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4227f0
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x42284e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xc]
mov dword [esi], 0
test al, 0xf
je 0x422835
test al, 0x10
mov ecx, 0x2000
mov eax, 0x80
cmovne eax, ecx
cmp dword [esi + 0x18], 0
mov ecx, dword [esi + 0x10]
push eax
push ecx
je 0x42282f
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x422835
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x14], 0
jbe 0x422841
mov eax, dword [esi + 0x10]
mov byte [eax], 0
cmp dword [esi + 0x14], 1
jbe 0x42284e
mov eax, dword [esi + 0x10]
mov byte [eax + 1], 0
pop esi
ret

Function at 0x423ef0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x423f20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
xor eax, eax
pop esi
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push dword [esi]
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
jne 0x423f50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
jmp 0x423f80
push dword [esi + 0xc]
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x423f92
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x425d75
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x425db4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425db4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425db4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x425db4
cmp dword [ecx + 0x74], 0xe
jbe 0x425db4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43b0c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43b0ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43b0ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405759
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.WinMain_start__lpCmdLine_is:
call esi
mov eax, dword [esp + 0x14]
xor edi, edi
cmp dword [esp + 0x14], edi
jne 0x405779
mov eax, str.NULL
push eax
call esi
push str.WinMain_start__parameter_is:
call esi
push str.package.nameZoom.msipackage.versionlatestpackage.size15272kdownloadRoothttps:__ringcentral.zoom.us_clientactionjoinbrowserchromeconfiddGlkPVlBNlIzQjUtUk95aDFnZ0g1V1czc2c_3Dconfno1494926523zc0mcv0.92.11227.0929stafalseinstaller.exeInstaller.exe
call esi
push 0x444
call fcn.00407fd2
pop ecx
cmp eax, edi
je 0x4057a5
mov edx, dword [esp + 0xc]
push eax
call fcn.0040588d
jmp 0x4057a7
xor eax, eax
push str.RingCentral_Downloader_Mutex_1.0.0.0_by_Zoom
push edi
push 0x1f0001
mov dword [0x41ddd8], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, edi
je 0x4057ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4057d3
call fcn.00406b5e
test eax, eax
jne 0x4057f3
push edi
push str.RingCentral_Boot_Downloader_by_Zoom
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x405842
push edi
push edi
push 0x7e9
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x405842
mov ecx, dword [esp + 0x14]
call fcn.00405d3c
mov eax, dword [0x41dddc]
cmp eax, edi
je 0x405812
push eax
call fcn.0040714a
pop ecx
mov dword [0x41dddc], edi
mov eax, dword [0x41dde8]
mov dword [0x41dde4], edi
cmp eax, edi
je 0x405826
call fcn.004024bf
mov eax, dword [0x41ddd8]
cmp eax, edi
je 0x405835
push eax
call fcn.00405849
push str.WinMain_end
mov dword [0x41ddd8], edi
call esi
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x41b140
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x426138], 0
jne 0x41b1c1
cmp dword [0x426158], 0
jne 0x41b170
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x426158], eax
test eax, eax
jne 0x41b170
push str.GetEnvironmentStrings_failed
call fcn.0041a95c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x426158]
jmp 0x41b184
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004154e4
pop ecx
mov edi, eax
test eax, eax
jne 0x41b17c
lea edi, [ebp + 1]
push edi
call fcn.00414de8
pop ecx
mov ebx, eax
mov dword [0x42613c], ebx
test ebx, ebx
jne 0x41b1ae
xor eax, eax
jmp 0x41b284
push edi
mov edx, dword [0x426158]
push edx
push ebx
call fcn.00415394
add esp, 0xc
jmp 0x41b1e1
xor esi, esi
mov ebx, dword [0x426138]
jmp 0x41b1db
push eax
call fcn.004154e4
pop ecx
test eax, eax
jne 0x41b1d7
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41b1cb
lea ebx, [esi + 4]
push 4
mov dword [0x426140], ebx
inc ebx
push ebx
call fcn.004148c0
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41b204
xor eax, eax
jmp 0x41b284
cmp dword [0x426138], 0
jne 0x41b235
xor esi, esi
mov ebx, dword [0x42613c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41b226
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004154e4
pop ecx
mov edi, eax
test eax, eax
jne 0x41b21c
jmp 0x41b266
xor esi, esi
mov ebx, dword [0x426138]
mov eax, dword [esp]
mov edi, eax
jmp 0x41b260
push eax
call fcn.004154e4
pop ecx
test eax, eax
je 0x41b255
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41b259
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41b244
mov eax, dword [0x426138]
test eax, eax
je 0x41b276
push eax
call fcn.00414df8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x426138], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xc36c0d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c36c0d
ret
Function at 0x417b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
jmp 0x417c21
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push str.SOFTWAREFujitsuCOBOL85
push reloc.F3BIFRM.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417b4f
mov eax, 1
jmp 0x417c3a
mov dword [ebp - 8], 0x208
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push str.FMBILANP
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417b9b
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x417c3a
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.FMDALANP
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 3
push 0
push 1
push Ordinal_3
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x417c00
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x417c3a
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417c33
mov eax, 9
jmp 0x417c3a
cmp dword [ebp - 0x21c], 0
je 0x417b1a
jmp 0x417c12
xor eax, eax
jmp 0x417c3a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d371
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x2000
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41d3a5
mov eax, 0x471
jmp 0x41d44d
push 0
lea eax, [ebp - 0x18]
push eax
push 0x2000
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 0
jne 0x41d3d7
mov dword [ebp - 8], 0
jmp 0x41d423
cmp dword [ebp - 0xc], 0
jne 0x41d3ed
mov dword [ebp - 8], 0x46e
jmp 0x41d423
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41d41e
mov dword [ebp - 8], 0x46f
jmp 0x41d423
jmp 0x41d3a5
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
jmp 0x41d44d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d452
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
jne 0x41d472
mov eax, 0x475
jmp 0x41d6f9
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x94], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x94], 0xffffffff
jne 0x41d517
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
jmp 0x41d4eb
mov eax, 0x474
jmp 0x41d6f9
mov eax, 0x476
jmp 0x41d6f9
mov eax, 0x475
jmp 0x41d6f9
mov eax, 0x477
jmp 0x41d6f9
cmp dword [ebp - 0xa0], 2
je 0x41d4c8
cmp dword [ebp - 0xa0], 3
je 0x41d4d2
cmp dword [ebp - 0xa0], 0x20
je 0x41d4be
jmp 0x41d4dc
push 0x9f4
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x41d555
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x478
jmp 0x41d6f9
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 0x440], eax
mov eax, dword [ebp - 0x9c]
mov byte [eax + 0x42a], 0x11
push 0x4c
mov eax, dword [ebp - 0x9c]
push eax
push 0
call fcn.00411280
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41d61d
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
cmp dword [eax + 0x424], 6
jne 0x41d5eb
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x473
jmp 0x41d6f9
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x472
jmp 0x41d6f9
push 0x55
mov eax, dword [ebp - 0x9c]
push eax
push 0
call fcn.00411280
add esp, 0xc
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x41d6f2
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa4], eax
jmp 0x41d6c6
mov eax, 0x474
jmp 0x41d6f9
mov eax, 0x476
jmp 0x41d6f9
mov eax, 0x475
jmp 0x41d6f9
mov eax, 0x477
jmp 0x41d6f9
cmp dword [ebp - 0xa4], 2
je 0x41d6a3
cmp dword [ebp - 0xa4], 3
je 0x41d6ad
cmp dword [ebp - 0xa4], 0x20
je 0x41d699
jmp 0x41d6b7
xor eax, eax
jmp 0x41d6f9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41dd00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
test byte [eax + 0x584], 1
jne 0x41dd2a
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x578]
mov dword [ebp - 8], eax
jmp 0x41dd36
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x580]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x14], 0
jb 0x41dd52
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
cmp dword [eax + 0x58c], ecx
jae 0x41dd69
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x424], 0x10601
mov eax, 0xffffffff
jmp 0x41de74
push 0
push 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp + 0x14]
push eax
mov eax, dword [0x43978c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41de08
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x424], 0x10602
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x41dde5
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x444], 6
jmp 0x41ddfe
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x444], 5
jmp 0x41ddfe
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x444], 1
jmp 0x41ddfe
cmp dword [ebp - 0x14], 5
je 0x41ddc1
cmp dword [ebp - 0x14], 6
je 0x41ddaf
jmp 0x41ddd3
mov eax, 0xffffffff
jmp 0x41de74
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [0x43978c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
je 0x41de55
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x424], 0x10603
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x444], eax
mov eax, 0xffffffff
jmp 0x41de74
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0x10]
push eax
call fcn.0042e4d0
add esp, 0xc
xor eax, eax
jmp 0x41de74
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e6e0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4311d8
push 0x42f894
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x43330c], eax
xor eax, eax
mov al, byte [0x43330d]
mov dword [0x433318], eax
mov eax, dword [0x43330c]
shr dword [0x43330c], 0x10
and eax, 0xff
mov dword [0x433314], eax
shl eax, 8
add eax, dword [0x433318]
mov dword [0x433310], eax
call fcn.0042f850
test eax, eax
jne 0x42e754
push 0x1c
call fcn.0042e880
add esp, 4
mov dword [ebp - 4], 0
call fcn.0042f670
call fcn.0042ec60
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x449d90], eax
call fcn.0042f4e0
mov dword [0x432eb0], eax
test eax, eax
je 0x42e787
cmp dword [0x449d90], 0
jne 0x42e791
push 0xffffffffffffffff
call fcn.0042ed80
add esp, 4
call fcn.0042f260
call fcn.0042f170
call fcn.0042ed50
mov esi, dword [0x449d90]
mov al, byte [esi]
cmp al, 0x22
je 0x42e7b8
cmp al, 0x20
jbe 0x42e7e5
inc esi
cmp byte [esi], 0x20
ja 0x42e7b0
jmp 0x42e7e5
inc esi
cmp byte [esi], 0x22
je 0x42e7e4
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x42e7df
xor eax, eax
mov al, bl
push eax
call fcn.0042f110
add esp, 4
test eax, eax
je 0x42e7d9
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x42e7c1
cmp byte [esi], 0x22
jne 0x42e7e5
inc esi
cmp byte [esi], 0
je 0x42e7f5
cmp byte [esi], 0x20
ja 0x42e7f5
inc esi
cmp byte [esi], 0
jne 0x42e7ea
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x42e819
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0042ed80
jmp 0x42e85a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42edc0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x433348], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x42edde
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x433344], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x433340], bl
jne 0x42ee38
cmp dword [0x449d88], 0
je 0x42ee26
mov edi, dword [0x449d84]
sub edi, 4
cmp edi, dword [0x449d88]
jb 0x42ee26
mov eax, dword [edi]
test eax, eax
je 0x42ee1b
call eax
sub edi, 4
cmp edi, dword [0x449d88]
jae 0x42ee13
push 0x432014
push 0x432010
call fcn.0042ee70
add esp, 8
push 0x43201c
push 0x432018
call fcn.0042ee70
add esp, 8
test ebx, ebx
jne 0x42ee5f
mov dword [0x433348], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x42f4e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x4333f0], ebx
jne 0x42f52f
call esi
cmp eax, ebx
mov edi, eax
je 0x42f50d
mov dword [0x4333f0], 1
jmp 0x42f52f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x42f525
mov dword [0x4333f0], 2
jmp 0x42f52f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4333f0], 1
jne 0x42f5de
test edi, edi
jne 0x42f552
call esi
mov edi, eax
test edi, edi
jne 0x42f552
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x42f56c
add esi, 2
cmp word [esi], 0
jne 0x42f55a
add esi, 2
cmp word [esi], 0
jne 0x42f55a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x42f5cd
push ebp
call fcn.0042fe30
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x42f5cd
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x42f5bc
push ebx
call fcn.0042fde0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4333f0], 2
jne 0x42f662
test ebx, ebx
jne 0x42f601
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x42f601
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x42f616
inc ebp
cmp byte [ebp], 0
jne 0x42f608
inc ebp
cmp byte [ebp], 0
jne 0x42f608
sub ebp, ebx
inc ebp
push ebp
call fcn.0042fe30
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x42f63b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x42f9b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x433408
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x42f9d7
add eax, 8
inc ecx
cmp eax, 0x433498
jb 0x42f9c8
cmp dword [ecx*8 + 0x433408], edx
lea ebx, [ecx*8]
jne 0x42fb9b
cmp dword [0x432ebc], 1
je 0x42fb57
cmp dword [0x432ebc], 0
jne 0x42fa0e
cmp dword [0x432ec0], 1
je 0x42fb57
cmp edx, 0xfc
je 0x42fb9b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x42fa4b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x42fa8f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4314b8
push ebp
call fcn.0042fbb0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x431498
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x43340c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00430640
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x449c80], 0
je 0x42fb6d
mov eax, dword [0x449c80]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x42fb77
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x43340c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x430910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x430935
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00430960
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x43095a
test byte [esp + 8], 2
je 0x43095a
mov dword [0x433300], 0xd
mov dword [0x433304], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret