joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c8e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.004a875c
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x42c9ba
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.00425ae0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00402650
test al, al
jne 0x42c9ab
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.00405b00
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42c9ab
test esi, esi
je 0x42c9ab
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00402290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret 4
Function at 0x42fad0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb8dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402750
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402750
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402750
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402750
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
call fcn.00402750
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
call fcn.00402750
mov byte [ebp - 4], 5
lea ecx, [esi + 0x90]
call fcn.00402750
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
call fcn.00402750
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.00402750
mov byte [ebp - 4], 8
lea ecx, [esi + 0xd8]
call fcn.00402750
mov byte [ebp - 4], 9
lea ecx, [esi + 0xf0]
call fcn.00402750
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x108]
call fcn.00402750
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x120]
call fcn.00402750
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x138]
call fcn.00402750
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x150]
call fcn.00402750
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x168]
call fcn.00402750
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x180]
call fcn.00402750
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x198]
call fcn.00402750
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x1b0]
call fcn.00402750
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0x1c8]
call fcn.00402750
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x1e0]
call fcn.00402750
mov byte [ebp - 4], 0x14
lea ecx, [esi + 0x1f8]
call fcn.00402750
mov byte [ebp - 4], 0x15
lea ecx, [esi + 0x210]
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42fc60
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb8dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0x15
lea ecx, [esi + 0x210]
call fcn.00402290
mov byte [ebp - 4], 0x14
lea ecx, [esi + 0x1f8]
call fcn.00402290
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x1e0]
call fcn.00402290
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0x1c8]
call fcn.00402290
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x1b0]
call fcn.00402290
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x198]
call fcn.00402290
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x180]
call fcn.00402290
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x168]
call fcn.00402290
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x150]
call fcn.00402290
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x138]
call fcn.00402290
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x120]
call fcn.00402290
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x108]
call fcn.00402290
mov byte [ebp - 4], 9
lea ecx, [esi + 0xf0]
call fcn.00402290
mov byte [ebp - 4], 8
lea ecx, [esi + 0xd8]
call fcn.00402290
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.00402290
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
call fcn.00402290
mov byte [ebp - 4], 5
lea ecx, [esi + 0x90]
call fcn.00402290
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
call fcn.00402290
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
call fcn.00402290
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402290
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402290
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402290
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4356a0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccadb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00426050
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00439620
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00439580
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00439620
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004394e0
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00439440
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00439440
mov dword [esi], eax
mov byte [ebp - 4], 0x14
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.00439440
mov dword [esi], eax
mov byte [ebp - 4], 0x17
lea ecx, [edi + 0x40]
call fcn.00401960
mov byte [ebp - 4], 0x18
lea ecx, [edi + 0x78]
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x435900
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccc4b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 8
lea ecx, [ebx + 0x78]
call fcn.00402290
mov byte [ebp - 4], 7
lea ecx, [ebx + 0x40]
call fcn.00402290
mov byte [ebp - 4], 6
lea esi, [ebx + 0x38]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.00438bd0
mov byte [ebp - 4], 6
push 0x38
push dword [esi]
call fcn.004a12e5
add esp, 8
mov byte [ebp - 4], 5
lea esi, [ebx + 0x30]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xc
mov ecx, esi
call fcn.00438bd0
mov byte [ebp - 4], 5
push 0x38
push dword [esi]
call fcn.004a12e5
add esp, 8
mov byte [ebp - 4], 4
lea esi, [ebx + 0x28]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xe
mov ecx, esi
call fcn.00438cd0
mov byte [ebp - 4], 4
push 0x38
push dword [esi]
call fcn.004a12e5
add esp, 8
mov byte [ebp - 4], 3
lea edi, [ebx + 0x20]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x11
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.00439190
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 3
push 0x40
push dword [edi]
call fcn.004a12e5
add esp, 8
mov byte [ebp - 4], 2
lea edi, [ebx + 0x18]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x15
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.00439230
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 2
push 0x30
push dword [edi]
call fcn.004a12e5
add esp, 8
mov byte [ebp - 4], 1
lea esi, [ebx + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x17
mov ecx, esi
call fcn.00438e40
mov byte [ebp - 4], 1
push 0x28
push dword [esi]
call fcn.004a12e5
add esp, 8
mov byte [ebp - 4], 0
lea edi, [ebx + 8]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x1a
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.00439230
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 0
push 0x30
push dword [edi]
call fcn.004a12e5
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0x1c
mov ecx, ebx
call fcn.00425d00
mov dword [ebp - 4], 0xffffffff
push 0x54
push dword [ebx]
call fcn.004a12e5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cccb5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
call fcn.00435ce0
cmp ebx, esi
je 0x435b4a
mov ecx, dword [ebx]
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [esi], ecx
mov ecx, dword [ebx + 4]
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov dword [esi + 4], ecx
mov ecx, edi
lea esi, [ebx + 0x40]
call fcn.00402850
cmp esi, eax
je 0x435b72
call fcn.00402850
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x435b67
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, esi
call fcn.00402870
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov al, byte [edi + 0x30]
mov byte [esi + 0x30], al
lea esi, [ebx + 0x78]
call fcn.00402850
cmp esi, eax
je 0x435bc5
call fcn.00402850
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x435bba
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, esi
call fcn.00402870
mov eax, dword [ebx]
mov esi, dword [eax]
cmp esi, eax
je 0x435c6e
cmp byte [esi + 8], 0x65
je 0x435bde
mov esi, dword [esi]
jmp 0x435c66
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [ebp - 0x10], edi
call fcn.00402650
test al, al
jne 0x435c0e
push edi
lea ecx, [ebx + 8]
call fcn.00438fa0
lea ecx, [esi + 0x24]
mov edi, eax
call fcn.00405b00
mov ecx, eax
call fcn.00412230
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [eax], edi
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea eax, [esi + 8]
dec dword [ebx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 3
lea ecx, [eax + 0x40]
call fcn.00406f60
mov byte [ebp - 4], 2
lea ecx, [esi + 0x3c]
call fcn.00406f60
mov byte [ebp - 4], 1
lea ecx, [esi + 0x24]
call fcn.00402290
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call fcn.00402290
push 0x54
push esi
call fcn.004a12e5
add esp, 8
mov esi, edi
cmp esi, dword [ebx]
jne 0x435bd1
mov ecx, ebx
call fcn.00435e10
mov ecx, ebx
call fcn.00435f80
mov ecx, ebx
call fcn.00436100
mov ecx, ebx
call fcn.00436290
mov ecx, ebx
call fcn.004364b0
mov ecx, ebx
call fcn.004369e0
mov ecx, ebx
call fcn.00436c80
mov esi, dword [ebp - 0x14]
mov ecx, ebx
push esi
call fcn.00436eb0
mov dword [ebp - 4], 0
mov ecx, ebx
mov dword [ebp - 0x18], 1
call fcn.00435ce0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x435ce0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cccf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 8]
lea ecx, [ebx + 8]
push dword [esi + 4]
call fcn.00439230
mov eax, dword [ebx + 8]
lea ecx, [ebx + 0x18]
mov dword [eax + 4], esi
mov eax, dword [ebx + 8]
mov dword [eax], esi
mov eax, dword [ebx + 8]
mov dword [eax + 8], esi
mov dword [ebx + 0xc], 0
mov esi, dword [ebx + 0x18]
push dword [esi + 4]
call fcn.00439230
mov eax, dword [ebx + 0x18]
lea ecx, [ebx + 0x10]
mov dword [eax + 4], esi
mov eax, dword [ebx + 0x18]
mov dword [eax], esi
mov eax, dword [ebx + 0x18]
mov dword [eax + 8], esi
mov dword [ebx + 0x1c], 0
call fcn.00438e40
mov esi, dword [ebx + 0x20]
lea ecx, [ebx + 0x20]
push dword [esi + 4]
call fcn.00439190
mov eax, dword [ebx + 0x20]
lea ecx, [ebx + 0x28]
mov dword [eax + 4], esi
mov eax, dword [ebx + 0x20]
mov dword [eax], esi
mov eax, dword [ebx + 0x20]
mov dword [eax + 8], esi
mov dword [ebx + 0x24], 0
call fcn.00438cd0
lea ecx, [ebx + 0x30]
call fcn.00438bd0
push 0
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.00426050
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 2
lea eax, [ebp - 0x14]
cmp ebx, eax
je 0x435dd1
mov eax, dword [ebx]
mov dword [ebx], ecx
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00425d00
mov dword [ebp - 4], 0xffffffff
push 0x54
push dword [ebp - 0x14]
call fcn.004a12e5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446010
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf53c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
call fcn.00402290
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.00402290
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.00402290
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00402290
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00402290
push 0x88
push ebx
call fcn.004a12e5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45f640
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x50e008]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.004a2d80
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45f69c
cmp dword [esp + 4], 6
jb 0x45f69c
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004a100a
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.004a100a
add esp, 0x118
ret
Function at 0x461d60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3f38
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [ebp - 0x14], 0
call fcn.004a101b
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [eax], 0
lea eax, [ebp - 0x134]
push 0x118
push 0
push eax
call fcn.004a2d80
add esp, 0xc
mov dword [ebp - 0x138], 0x11c
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x461de7
cmp dword [ebp - 0x134], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040b5f0
test al, al
je 0x461e14
lea ecx, [ebp - 0x14]
call fcn.0040aba0
test al, al
jne 0x461e14
xor bl, bl
jmp 0x461f1e
lea edx, [esi + 4]
xor ecx, ecx
call fcn.00477760
test al, al
jne 0x461e53
lea ecx, [esi + 4]
call fcn.00402850
mov dword [ebp - 0x13c], 0
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], 0
jb 0x461e43
mov eax, dword [eax]
lea ecx, [ebp - 0x13c]
push ecx
push eax
call fcn.00402a20
add esp, 8
lea edx, [esi + 0x1c]
mov ecx, 0x1a
call fcn.00477760
test al, al
jne 0x461e95
lea ecx, [esi + 0x1c]
call fcn.00402850
mov dword [ebp - 0x13c], 0
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], 0
jb 0x461e85
mov eax, dword [eax]
lea ecx, [ebp - 0x13c]
push ecx
push eax
call fcn.00402a20
add esp, 8
lea edx, [esi + 0x34]
mov ecx, 2
call fcn.00477760
test al, al
jne 0x461ed7
lea ecx, [esi + 0x34]
call fcn.00402850
mov dword [ebp - 0x13c], 0
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], 0
jb 0x461ec7
mov eax, dword [eax]
lea ecx, [ebp - 0x13c]
push ecx
push eax
call fcn.00402a20
add esp, 8
lea edx, [esi + 0x4c]
mov ecx, 0xb
call fcn.00477760
test al, al
jne 0x461f19
lea ecx, [esi + 0x4c]
call fcn.00402850
mov dword [ebp - 0x13c], 0
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], 0
jb 0x461f09
mov eax, dword [eax]
lea ecx, [ebp - 0x13c]
push ecx
push eax
call fcn.00402a20
add esp, 8
mov byte [esi], 1
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040a4e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret
Function at 0x461f50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3f81
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], 0
call fcn.00402850
mov edx, eax
cmp dword [eax + 0x14], 8
jb 0x461f9c
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x461fb3
mov eax, edx
cmp word [eax], 0x25
je 0x461fe9
add eax, 2
sub ecx, 1
jne 0x461fa5
push edi
mov ecx, esi
call fcn.00402770
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x461fb3
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x461fb3
push edi
lea ecx, [ebp - 0x28]
call fcn.00402770
mov dword [ebp - 4], 1
mov ecx, edi
push 0
push 0
call fcn.00405b00
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x46203c
push edi
mov ecx, esi
call fcn.00402770
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00402290
jmp 0x461fc9
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a173e
mov edx, dword [ebp - 0x30]
add esp, 4
inc edx
mov ebx, eax
mov ecx, edi
push edx
push ebx
call fcn.00405b00
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x462090
cmp eax, dword [ebp - 0x30]
ja 0x462090
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call fcn.00402a80
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push ebx
call fcn.00402870
push ebx
call fcn.004a1739
add esp, 4
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00405b10
jmp 0x462027
Function at 0x4629b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d40ce
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x208
push 0
push eax
call fcn.004a2d80
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.MacromedFlashFlashHelperService.exe
lea ecx, [ebp - 0x26c]
call fcn.00402700
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x254]
call fcn.00402700
mov byte [ebp - 4], 1
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040a200
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x254]
call fcn.00402290
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x26c]
call fcn.00402290
lea eax, [ebp - 0x234]
push eax
call fcn.00407bf0
add esp, 4
test al, al
je 0x462b2e
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x238], 0
call fcn.004a101b
add esp, 4
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 5
mov dword [eax], 0
mov dword [eax], 0xffffffff
mov byte [ebp - 4], 4
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x234]
push 0x80
push 4
push 1
push 0x80000000
push eax
lea ecx, [ebp - 0x238]
call fcn.00414160
test al, al
jne 0x462b32
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x238]
test esi, esi
je 0x462b2e
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x462b19
test eax, eax
je 0x462b19
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.004a12e5
add esp, 8
mov dword [ebp - 0x238], 0
xor bl, bl
jmp 0x462b7b
push esi
lea ecx, [ebp - 0x238]
call fcn.00414310
mov bl, al
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x238]
test esi, esi
je 0x462b7b
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x462b66
test eax, eax
je 0x462b66
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.004a12e5
add esp, 8
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00402290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret 4