joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414810
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ae87
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.0043a5e9
add esp, 4
mov edi, eax
xorps xmm0, xmm0
push 0
push 0
movq qword [edi], xmm0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x4149a9
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x464e1c
push 1
push 0
push 0x464e0c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4149a3
push 0xc
mov dword [ebp - 0x18], 0
call fcn.0043a5e9
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4148f3
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
push str.ROOTCIMV2
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x4149d3
jmp 0x4148f5
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4149dd
lea edx, [ebp - 0x18]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push edx
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push dword [esi]
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x414972
mov ecx, dword [esi]
test ecx, ecx
je 0x414950
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x414967
push eax
call fcn.0043a324
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0043a86a
add esp, 8
test ebx, ebx
js 0x41499a
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [ebp - 0x18]
jns 0x4149ad
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x4149b7
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.00439e50
push 0x8007000e
call fcn.00439e50
int3
Function at 0x414d50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45af08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00430330
lea ecx, [ebp - 0x2c]
call fcn.00410160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov edx, 0x40000000
cmovae ecx, dword [ebp - 0x2c]
add esp, 0x10
push 2
push ecx
push 0
call fcn.00411600
mov edi, eax
add esp, 0x14
cmp edi, 0xffffffff
je 0x414de9
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebp + 0x30]
lea ecx, [ebp + 0x20]
cmovae ecx, dword [ebp + 0x20]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x414deb
xor esi, esi
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x414e25
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414e1b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414ec8
push edx
push ecx
call fcn.0043a86a
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 0x10
jb 0x414e69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414e5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414ec8
push edx
push ecx
call fcn.0043a86a
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x414eab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414ea1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414ec8
push edx
push ecx
call fcn.0043a86a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
call fcn.0044532a
int3

Function at 0x4152a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x47802c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
sub esp, 0x18
mov eax, ecx
mov ecx, esp
push eax
call fcn.00430330
lea ecx, [esp + 0x24]
call fcn.00410160
add esp, 0x18
lea eax, [esp + 0xc]
cmp dword [esp + 0x20], 8
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [esp + 0x20]
test eax, eax
setne bl
cmp edx, 8
jb 0x415320
mov ecx, dword [esp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415316
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415332
push edx
push ecx
call fcn.0043a86a
add esp, 8
mov ecx, dword [esp + 0x24]
mov al, bl
pop ebx
xor ecx, esp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
call fcn.0044532a
int3
Function at 0x415740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b032
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push 0x104
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x21c], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
sub esp, 0x18
lea ecx, [ebp - 0x218]
mov edx, esp
lea edi, [ecx + 2]
xor eax, eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4157c0
sub ecx, edi
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00430ec0
mov ecx, esi
call fcn.00410040
add esp, 0x18
mov dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x21c], 3
jb 0x415806
mov eax, dword [esi]
cmp byte [eax + ecx - 1], 0x5c
je 0x415819
push 0x46e450
mov ecx, esi
call fcn.004300e0
push str.system32cmd.exe
mov ecx, esi
call fcn.004300e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret

Function at 0x415ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push 0x46eb20
push eax
lea eax, [ebp - 8]
push eax
call fcn.004445d9
mov ecx, dword [ebp - 8]
add esp, 0xc
test ecx, ecx
je 0x415f06
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
push esi
cmovae eax, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x30]
push ecx
push edi
push 1
push eax
call fcn.00444367
push dword [ebp - 8]
mov esi, eax
call fcn.00440295
add esp, 0x14
cmp esi, edi
pop edi
pop esi
jne 0x415f06
mov bl, 1
jmp 0x415f08
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x415f38
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x415f2e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415f8b
push edx
push ecx
call fcn.0043a86a
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x415f7a
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x415f70
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415f8b
push edx
push ecx
call fcn.0043a86a
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043a313
mov esp, ebp
pop ebp
ret
call fcn.0044532a
int3
Function at 0x4178a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b248
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x104], 0
jne 0x417934
sub esp, 0x18
lea edx, [esi + 0x3c]
mov ecx, esp
push str.cnf.dat
call fcn.00431e20
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.004159b0
add esp, 0x18
lea ecx, [esi + 0xf4]
push eax
call fcn.00430250
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x417934
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41792a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4179fe
push edx
push ecx
call fcn.0043a86a
add esp, 8
sub esp, 0x18
lea eax, [esi + 0x3c]
mov ecx, esp
push eax
call fcn.00430330
lea ecx, [ebp - 0x30]
call fcn.004159b0
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x417955
mov eax, dword [eax]
push eax
call fcn.00444af1
mov edx, dword [ebp - 0x1c]
add esp, 4
cmp edx, 0x10
jb 0x41798e
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x417984
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417a03
push edx
push ecx
call fcn.0043a86a
add esp, 8
add esi, 0xf4
mov ecx, esi
call fcn.004152a0
test al, al
jne 0x4179e4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
push 0x46e3c9
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], al
call fcn.004314f0
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
push esi
call fcn.00430330
mov dword [ebp - 4], 0xffffffff
call fcn.00415ea0
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
call fcn.0044532a
call fcn.0044532a
int3
Function at 0x41a930
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b6b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x47802c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x41aa78
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea edi, [ebx + 8]
push edi
push 0x464e1c
push 1
push 0
push 0x464e0c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41aa72
push str.RootDefault
lea ecx, [ebp - 0x10]
call fcn.00412fd0
mov dword [ebp - 4], 0
mov eax, dword [eax]
test eax, eax
je 0x41a9c2
mov edx, dword [eax]
jmp 0x41a9c4
xor edx, edx
mov ecx, dword [edi]
add ebx, 4
push ebx
push 0
push 0
mov eax, dword [ecx]
push 0
push 0
push 0
push 0
push edx
push ecx
call dword [eax + 0xc]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
test esi, esi
je 0x41aa3c
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x41aa35
test esi, esi
je 0x41aa35
mov eax, dword [esi]
test eax, eax
je 0x41aa10
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x41aa27
push eax
call fcn.0043a324
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0043a86a
mov eax, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 0x10], 0
test eax, eax
js 0x41aa72
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebx]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x41aa8e
mov ecx, dword [ebx]
test ecx, ecx
je 0x41aa66
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x41aa72
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x428050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x47802c]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov esi, ecx
call fcn.00412b40
cmp eax, 6
jl 0x428158
mov eax, dword [esi + 0x2c]
cmp dword [eax + 0x34], 0
je 0x428158
mov ecx, esi
call fcn.00429d80
cmp byte [0x47a498], 0
jne 0x4280ef
test al, al
jne 0x428158
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00427e30
mov ecx, dword [esi + 0x2c]
lea edx, [esp + 0xc]
add ecx, 0x24
call fcn.00432780
test al, al
je 0x428168
mov edx, dword [esp + 0x20]
cmp edx, 0x10
jb 0x428158
mov ecx, dword [esp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42814e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42816f
jmp 0x42814e
cmp dword [0x4789a0], 0
je 0x428158
sub esp, 0x18
mov ecx, esp
push 0x478990
call fcn.0042ff50
lea ecx, [esp + 0x24]
call fcn.00410040
mov ecx, dword [esi + 0x2c]
lea edx, [esp + 0x24]
add esp, 0x18
add ecx, 0x24
call fcn.00432780
test al, al
je 0x428174
mov edx, dword [esp + 0x20]
cmp edx, 0x10
jb 0x428158
mov ecx, dword [esp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42814e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42817b
push edx
push ecx
call fcn.0043a86a
add esp, 8
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
push 0
call fcn.0043fd54
call fcn.0044532a
push 0
call fcn.0043fd54
call fcn.0044532a
int3
Function at 0x42baf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45cfa8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x46e3c9
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004302d0
mov byte [ebp - 4], 1
call fcn.00412b40
lea ecx, [ebp - 0x5c]
cmp eax, 6
jge 0x42bbdd
push str.IC9jIEZPUiAvbCAlaSBpbiAoMSwxLDEwKSBETyBJRiBOT1QgRVhJU1QgIlt0aGlzLT5hcHBQYXRoXSIgKGV4aXQpIEVMU0UgKChERUwgL0YgL1EgIlt0aGlzLT5hcHBQYXRoXSIpICYgKHBpbmcgMTI3LjAuMC4xIC1uIDIgPiBudWwpKQ
call fcn.004302d0
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.0040fd20
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00430150
lea ecx, [ebp - 0x74]
call fcn.00430200
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00430200
push str._this__appPath_
lea ecx, [ebp - 0x5c]
call fcn.004302d0
add esi, 4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x5c]
push esi
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x74]
call fcn.0040f1c0
add esp, 8
lea ecx, [ebp - 0x2c]
push eax
call fcn.00430250
lea ecx, [ebp - 0x74]
call fcn.00430200
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00430200
push str._this__appPath_
lea ecx, [ebp - 0x5c]
call fcn.004302d0
mov byte [ebp - 4], 5
jmp 0x42bc6c
push str.IC9jIEZPUiAvbCAlaSBpbiAoMSwxLDEwKSBETyBJRiBOT1QgRVhJU1QgIlt0aGlzLT5hcHBQYXRoXSIgKGV4aXQpIEVMU0UgKChERUwgL0YgL1EgIlt0aGlzLT5hcHBQYXRoXSIpICYgdGltZW91dCAvdCAxKQ
call fcn.004302d0
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x74]
call fcn.0040fd20
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 7
call fcn.00430150
lea ecx, [ebp - 0x74]
call fcn.00430200
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00430200
push str._this__appPath_
lea ecx, [ebp - 0x5c]
call fcn.004302d0
add esi, 4
mov byte [ebp - 4], 8
lea eax, [ebp - 0x5c]
push esi
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x74]
call fcn.0040f1c0
add esp, 8
lea ecx, [ebp - 0x2c]
push eax
call fcn.00430250
lea ecx, [ebp - 0x74]
call fcn.00430200
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00430200
push str._this__appPath_
lea ecx, [ebp - 0x5c]
call fcn.004302d0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x5c]
push esi
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x74]
call fcn.0040f1c0
add esp, 8
lea ecx, [ebp - 0x2c]
push eax
call fcn.00430250
lea ecx, [ebp - 0x74]
call fcn.00430200
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00430200
lea ecx, [ebp - 0x44]
call fcn.00415740
sub esp, 0x18
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x78], esp
mov ecx, esp
push eax
call fcn.00430330
sub esp, 0x18
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.00430330
mov byte [ebp - 4], 0xa
call fcn.004127a0
add esp, 0x30
lea ecx, [ebp - 0x44]
call fcn.00430200
lea ecx, [ebp - 0x2c]
call fcn.00430200
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.0043fd54
mov eax, 0x42bce7
ret
Function at 0x42eb00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x42ebe6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x42ebd5
jg 0x42eb40
test edx, edx
je 0x42ebd5
nop dword [eax]
call fcn.00430e80
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x42eb94
jg 0x42eb57
test esi, esi
je 0x42eb94
cmp ebx, eax
jg 0x42eb67
jl 0x42eb61
cmp edi, esi
jae 0x42eb67
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0043c3d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x42ebb9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x42ebcf
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x42eb40
jl 0x42ebcf
test edi, edi
jne 0x42eb40
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x42ec08
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x42ec0a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x42ec88
jg 0x42ec1d
test esi, esi
je 0x42ec88
test eax, eax
jl 0x42ec62
jg 0x42ec27
test ebx, ebx
je 0x42ec62
cmp edi, eax
jg 0x42ec37
jl 0x42ec31
cmp esi, ebx
jae 0x42ec37
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0043c3d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x42ec65
mov edx, dword [ebp + 8]
test edi, edi
jl 0x42ec88
jg 0x42ec6f
test esi, esi
je 0x42ec88
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x42ec88
push eax
push esi
push 1
push edx
call fcn.00444367
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42f200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x42f230
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x42f26c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x42f26c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x42f353
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x42f294
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42f2c7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0043fd93
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x42f353
cmp eax, 1
jle 0x42f326
cmp eax, 3
jne 0x42f353
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0043fd93
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x42f343
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00444367
add esp, 0x10
cmp edi, eax
jne 0x42f353
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x42f257
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a313
mov esp, ebp
pop ebp
ret 4
Function at 0x4309d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x430a8a
cmp byte [esi + 0x3d], 0
je 0x430a8a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x430a78
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x430a40
sub eax, 1
je 0x430a44
sub eax, 2
jne 0x430a78
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x430a61
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00444367
add esp, 0x10
cmp edi, eax
jne 0x430a78
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0043a313
mov esp, ebp
pop ebp
ret