joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x41d7a4
test eax, eax
jne 0x41d936
mov edi, dword [0x4529c4]
test edi, edi
je 0x41d936
xor ebx, ebx
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x41d7d3
mov edi, dword [edi + 8]
test edi, edi
je 0x41d7ee
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x41d7c0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
mov edi, dword [edi + 8]
test edi, edi
jne 0x41d7c7
test bl, 1
je 0x41d936
mov edi, dword [0x4529c4]
test edi, edi
je 0x41d936
xor ebx, ebx
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x41d833
nop word cs:[eax + eax]
nop dword [eax]
mov edi, dword [edi + 8]
test edi, edi
je 0x41d84e
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x41d820
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
mov edi, dword [edi + 8]
test edi, edi
jne 0x41d827
test bl, 1
je 0x41d936
mov edi, dword [0x4529c4]
test edi, edi
je 0x41d936
xor ebx, ebx
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x41d893
nop word cs:[eax + eax]
nop dword [eax]
mov edi, dword [edi + 8]
test edi, edi
je 0x41d8ae
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x41d880
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
mov edi, dword [edi + 8]
test edi, edi
jne 0x41d887
test bl, 1
je 0x41d936
mov edi, dword [0x4529c4]
test edi, edi
je 0x41d936
xor ebx, ebx
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x41d8e3
nop
mov edi, dword [edi + 8]
test edi, edi
je 0x41d8fe
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x41d8d0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
mov edi, dword [edi + 8]
test edi, edi
jne 0x41d8d7
test bl, 1
je 0x41d936
mov edi, dword [0x4529c4]
test edi, edi
jne 0x41d916
jmp 0x41d936
mov edi, dword [edi + 8]
test edi, edi
je 0x41d936
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x41d90f
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
jmp 0x41d90f
mov al, byte [0x44df58]
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x41d970
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x436540
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov ecx, 0x4529f4
mov dword fs:[0], eax
call fcn.0041f040
mov dword [ebp - 0x20], 0x4529f4
mov edi, dword [esi]
test edi, edi
jne 0x41da15
mov ebx, dword [esi + 4]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x41da37
mov edi, eax
test ebx, ebx
je 0x41da0d
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x41da8b
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x4529c4]
nop word cs:[eax + eax]
nop dword [eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x4529c4], ecx
jne 0x41da00
mov eax, edi
test edi, edi
xchg dword [esi], eax
je 0x41da57
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0xffffffff
call fcn.0041f160
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXES
mov edx, 0x2e
push 0x4489d4
call fcn.0041f130
add esp, 4
jmp 0x41da89
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x4489e4
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
call fcn.0041fac0
ud2
mov ecx, 0xc
mov edx, 4
call fcn.0040dcf0
ud2

Function at 0x41dac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0xc
mov eax, dword [0x452040]
test eax, eax
je 0x41dae7
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x41dafb
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x41db77
jmp 0x41db37
mov ecx, 0x452040
call fcn.0041d970
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x41dad8
call sub.KERNEL32.dll_GetProcessHeap
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x41db7f
mov dword [eax], 0
mov dword [eax + 0xc], 0x452040
mov esi, eax
mov eax, dword [0x452040]
test eax, eax
jne 0x41db30
mov ecx, 0x452040
call fcn.0041d970
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
je 0x41db77
test eax, eax
je 0x41db77
lock dec dword [eax]
jne 0x41db77
lea ecx, [esp + 8]
call fcn.0041e0f0
mov eax, edi
add esp, 0xc
pop esi
pop edi
ret
mov ecx, 0x10
mov edx, 4
call fcn.0040dcf0
ud2
Function at 0x41f8a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x45205c]
test eax, eax
je 0x41f8be
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x41f8d3
cmp dword [eax], 1
mov esi, eax
jne 0x41f8d3
jmp 0x41f936
mov ecx, 0x45205c
call fcn.0041d970
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x41f8b5
mov eax, dword [0x45205c]
test eax, eax
je 0x41f93d
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x41f952
mov esi, eax
test eax, eax
jne 0x41f929
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x41f958
mov dword [eax], 0
mov dword [eax + 8], 0x45205c
mov esi, eax
mov eax, dword [0x45205c]
test eax, eax
jne 0x41f922
mov ecx, 0x45205c
call fcn.0041d970
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi + 4], 0
mov dword [esi], 1
add esi, 4
mov eax, esi
pop esi
ret
mov ecx, 0x45205c
call fcn.0041d970
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x41f8e7
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.0040dcf0
ud2
Function at 0x424850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov bl, byte [edx + 0x1d]
call 0x42485f
pop eax
mov edi, ecx
mov ebp, edx
mov edx, 0
mov esi, 0
mov dword [esp], 0
mov dword [esp + 4], eax
xor eax, eax
test bl, bl
setne al
xor ecx, ecx
cmp bl, 1
lea eax, [eax + eax - 1]
cmove eax, ecx
inc eax
cmp eax, 1
ja 0x4248a6
movzx edx, byte [ebp + 0x1c]
ja 0x4248e9
mov ecx, ebp
mov esi, edx
call fcn.00424730
mov edx, esi
movzx esi, al
test bl, bl
mov dword [esp + 8], edi
jne 0x424933
xor ecx, ecx
cmp byte [ebp + 8], 6
lea eax, [ebp + 8]
mov dword [esp], 0
cmove eax, ecx
je 0x424933
movzx ecx, byte [eax]
mov edi, dword [esp + 4]
mov dword [esp], 2
add edi, dword [ecx*4 + 0x424af0]
jmp edi
xor esi, esi
test bl, bl
mov dword [esp + 8], edi
jne 0x424933
jmp 0x4248b2
lea ecx, [esi + edx]
mov edi, dword [ebp + 4]
mov dword [esp + 4], edx
mov dword [esp + 0x10], esi
add ecx, dword [esp]
cmp edi, ecx
jb 0x424ae5
mov ebx, dword [ebp]
mov eax, ebp
mov ebp, edi
xor esi, esi
sub ebp, ecx
mov dword [esp + 0x1c], eax
lea edx, [ebx + ecx]
je 0x424a83
mov al, byte [eax + 8]
lea ecx, [ebx + edi]
mov esi, dword [esp]
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
xor ecx, ecx
cmp al, 3
setb cl
cmp al, 6
mov eax, 2
cmovne eax, ecx
cmp al, 2
setne cl
and cl, al
mov eax, dword [esp + 4]
lea edx, [esi + eax]
lea eax, [edi + ebx - 1]
xor ebx, ebx
add edx, dword [esp + 0x10]
mov esi, edx
sub esi, edi
nop word cs:[eax + eax]
mov ch, byte [eax + ebx]
test cl, cl
jne 0x4249c0
cmp ch, 0x2f
je 0x424a4c
cmp ch, 0x5c
je 0x424a4c
dec ebx
cmp esi, ebx
jne 0x4249b0
mov edi, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor esi, esi
add esi, ebp
mov eax, 5
test ebp, ebp
je 0x424ab5
cmp ebp, 2
je 0x424a98
cmp ebp, 1
jne 0x424ab0
cmp edx, 0x448553
je 0x424a0a
cmp byte [edx], 0x2e
jne 0x424ab0
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov al, byte [eax + 8]
cmp al, 3
setb cl
cmp al, 6
mov eax, 2
cmovne eax, ecx
cmp al, 2
setne cl
and cl, al
mov eax, ecx
xor al, 1
cmp edx, 0x448553
movzx eax, al
lea eax, [eax + eax*2 + 2]
je 0x424ab5
test cl, cl
jne 0x424ab5
cmp byte [edx], 0x2e
mov eax, 5
jne 0x424ab0
jmp 0x424ab5
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add edx, eax
sub edx, ebp
lea ecx, [edx + ebx]
cmp edi, ecx
jb 0x424ae5
add ebp, edi
mov ecx, dword [esp + 0x18]
mov esi, 1
sub ebp, dword [esp]
add ecx, edx
sub ebp, dword [esp + 0x10]
add ecx, ebx
mov edx, ecx
sub ebp, dword [esp + 4]
sub ebp, eax
sub ebp, ebx
mov edi, dword [esp + 8]
add esi, ebp
mov eax, 5
test ebp, ebp
jne 0x4249e7
jmp 0x424ab5
mov eax, 3
cmp edx, 0x448554
je 0x424ab5
movzx ecx, word [edx]
cmp ecx, 0x2e2e
je 0x424ab5
mov eax, 4
mov dword [edi], esi
mov dword [edi + 4], eax
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov dword [edi + 8], edx
mov dword [edi + 0xc], ebp
movsd qword [edi + 0x10], xmm0
movsd qword [edi + 0x18], xmm1
mov dword [edi + 0x20], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, edi
call fcn.00410500
ud2
Function at 0x429360
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov eax, edx
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, ecx
test al, al
je 0x429385
mov ecx, esi
push edi
call fcn.004293f0
add esp, 0x14
pop esi
pop edi
pop ebx
ret
mov ecx, esp
push edi
call fcn.004252a0
add esp, 4
cmp dword [esp], 1
jne 0x4293a2
movsd xmm0, qword [esp + 4]
movsd qword [esi], xmm0
jmp 0x4293cb
mov edi, dword [esp + 4]
mov ebx, dword [esp + 8]
push 0
push edi
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x4293d2
mov byte [esi], 3
test ebx, ebx
je 0x4293cb
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
add esp, 0x10
pop esi
pop edi
pop ebx
ret
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 4], eax
mov dword [esi], 0
test ebx, ebx
jne 0x4293bd
jmp 0x4293cb
Function at 0x42dca0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x436950
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [0x452040]
test eax, eax
jne 0x42dcf1
mov ecx, 0x452040
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 0
call fcn.0041d970
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x42dd10
cmp dword [eax], 1
jne 0x42dd10
add eax, 4
mov ecx, dword [eax]
inc ecx
test ecx, ecx
jg 0x42dd33
jmp 0x42ddf2
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 0
call fcn.0041dac0
test eax, eax
je 0x42de6c
mov ecx, dword [eax]
inc ecx
test ecx, ecx
jle 0x42ddf2
cmp dword [eax + 4], 0
jne 0x42de1d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [0x452040]
test eax, eax
jne 0x42dd61
mov ecx, 0x452040
mov byte [ebp - 0x1e], 1
mov dword [ebp - 0x10], 1
call fcn.0041d970
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x42dd86
cmp dword [eax], 1
mov ecx, eax
jne 0x42dd86
add ecx, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp dword [ecx], 0
je 0x42ddaf
jmp 0x42de44
mov byte [ebp - 0x1e], 1
mov dword [ebp - 0x10], 1
call fcn.0041dac0
mov ecx, eax
test eax, eax
je 0x42de8d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp dword [ecx], 0
jne 0x42de44
mov dword [ecx], 0xffffffff
mov dword [ebp - 0x28], ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x42ddd6
lock dec dword [eax]
jne 0x42ddd6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 3
lea ecx, [eax + 4]
call fcn.0041e0f0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 4], eax
inc dword [ecx]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
mov ecx, 0x447f44
mov edx, 0x18
push 0x447f5c
push eax
call fcn.00411a20
add esp, 8
jmp 0x42dece
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 0
mov ecx, 0x4490de
mov edx, 0x26
push 0x449104
call fcn.0041f130
add esp, 4
jmp 0x42dece
mov byte [ebp - 0x21], 1
mov dword [ebp - 0x10], 2
lea eax, [ebp - 0x20]
mov ecx, str.already_borrowed_sA
mov edx, 0x10
push 0x447f7c
push eax
call fcn.00411a20
add esp, 8
jmp 0x42dece
mov byte [ebp - 0x1d], 1
lea eax, [ebp - 0x20]
mov ecx, 0x44943b
mov edx, 0x46
push 0x448144
push eax
call fcn.00411a20
add esp, 8
jmp 0x42dece
mov eax, dword [ebp - 0x28]
lock dec dword [eax]
jne 0x42dea8
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x10], 0
call fcn.0041e0f0
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
mov ecx, 0x44943b
mov edx, 0x46
push 0x448144
push eax
call fcn.00411a20
add esp, 8
ud2
Function at 0x42e470
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4369a0
mov eax, dword [ebp + 8]
mov edi, ecx
lea ecx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], ecx
lea ecx, [ebp - 0x3c]
push eax
call fcn.004252a0
add esp, 4
cmp dword [ebp - 0x3c], 1
jne 0x42e4c3
movsd xmm0, qword [ebp - 0x38]
movsd qword [edi], xmm0
jmp 0x42e552
lea ecx, [ebp - 0x38]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + 8]
movsd xmm0, qword [ecx]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x24], esi
movsd qword [ebp - 0x2c], xmm0
push eax
call fcn.004252a0
add esp, 4
mov esi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
cmp dword [ebp - 0x3c], 1
jne 0x42e516
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov dword [eax + 4], ebx
cmp dword [ebp - 0x28], 0
je 0x42e552
mov esi, dword [ebp - 0x2c]
call sub.KERNEL32.dll_GetProcessHeap
push esi
jmp 0x42e54a
mov edi, dword [ebp - 0x2c]
push 1
push esi
push edi
call sub.KERNEL32.dll_MoveFileExW
test eax, eax
je 0x42e563
mov eax, dword [ebp - 0x20]
test ebx, ebx
mov byte [eax], 3
je 0x42e53e
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp dword [ebp - 0x28], 0
je 0x42e552
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp - 0x20]
test ebx, ebx
mov dword [ecx + 4], eax
mov dword [ecx], 0
je 0x42e505
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp dword [ebp - 0x28], 0
jne 0x42e50b
jmp 0x42e552
Function at 0x42ee90
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x4369c0
mov ebx, dword [ebp + 8]
mov edi, ecx
lea ecx, [esi + 0x30]
mov eax, dword fs:[0]
mov dword [esi + 0x30], eax
mov dword fs:[0], ecx
lea ecx, [esi + 8]
push ebx
call fcn.004252a0
add esp, 4
cmp dword [esi + 8], 1
jne 0x42eef3
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [edi + 8], ecx
mov dword [edi + 4], eax
mov dword [edi], 1
jmp 0x42efb6
lea ecx, [esi + 0xc]
mov dword [esi + 4], edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x38], 0
mov edi, dword [ecx + 8]
movsd xmm0, qword [ecx]
lea ecx, [esi + 8]
mov dword [esi + 0x20], edi
movsd qword [esi + 0x18], xmm0
push eax
call fcn.004252a0
add esp, 4
mov edi, dword [esi + 0xc]
mov ebx, dword [esi + 0x10]
cmp dword [esi + 8], 1
jne 0x42ef4d
mov eax, dword [esi + 4]
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax], 1
cmp dword [esi + 0x1c], 0
je 0x42efb6
mov edi, dword [esi + 0x18]
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x42efae
mov eax, dword [esi + 0x18]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push 0
push 0
lea ecx, [esi + 8]
push ecx
push 0x42f030
push edi
mov dword [esi + 0x24], eax
push eax
call sub.KERNEL32.dll_CopyFileExW
test eax, eax
je 0x42efc7
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0xc]
test ebx, ebx
mov dword [edx + 0xc], ecx
mov dword [edx + 8], eax
mov dword [edx], 0
je 0x42efa0
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp dword [esi + 0x1c], 0
je 0x42efb6
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 0x24]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [esi + 4]
test ebx, ebx
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 1
je 0x42ef3c
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp dword [esi + 0x1c], 0
jne 0x42ef42
jmp 0x42efb6
Function at 0x42f050
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4369d0
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 8]
mov dword fs:[0], eax
mov dword [ebp - 0x40], edx
add ecx, edx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x30]
mov word [ebp - 0x38], 0
call fcn.00426f60
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp edi, ebx
jne 0x42f0f8
mov ebx, edi
inc ebx
je 0x42f173
lea eax, [edi + edi]
cmp eax, ebx
cmova ebx, eax
mov eax, ebx
mov esi, ebx
add eax, ebx
setae al
add esi, ebx
jb 0x42f173
test esi, esi
js 0x42f173
test edi, edi
mov byte [ebp - 0x1d], al
je 0x42f14f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
call sub.KERNEL32.dll_GetProcessHeap
push esi
push dword [ebp - 0x34]
push 0
push eax
call sub.KERNEL32.dll_HeapReAlloc
test eax, eax
je 0x42f161
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov esi, dword [ebp - 0x30]
mov word [esi + edi*2], 0
inc edi
mov dword [ebp - 0x28], edi
push esi
call sub.KERNEL32.dll_SetCurrentDirectoryW
test eax, eax
je 0x42f138
mov eax, dword [ebp - 0x24]
mov byte [eax], 3
test ebx, ebx
je 0x42f127
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ecx], 0
test ebx, ebx
jne 0x42f119
jmp 0x42f127
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x42f0f2
mov al, byte [ebp - 0x1d]
xor edx, edx
mov ecx, esi
mov dl, al
add edx, edx
call fcn.0040dcf0
ud2
mov dword [ebp - 0x10], 0
call fcn.0040dd00
ud2
Function at 0x4350e0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x436a70
mov ebx, ecx
lea eax, [ebp - 0x18]
lea esi, [ebp - 0x38]
lea edi, [ebp - 0x24]
mov dword [ebp - 0x20], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
push 0
push esi
push edi
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
je 0x4351f5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
cmp byte [ebp - 0x20], 0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov eax, esi
mov dword [ebp - 0x38], ecx
cmovne eax, edi
cmovne edi, esi
mov edi, dword [edi]
mov esi, dword [eax]
push 0
push 1
push edi
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x43520c
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
je 0x435191
push dword [ebx + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [ebx], 1
mov dword [ebx + 4], edi
call sub.KERNEL32.dll_GetProcessHeap
push 0x14
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x435241
mov ecx, dword [ebp + 0xc]
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], esi
mov dword [ebp - 0x20], eax
cmp dword [ecx], 0
je 0x4351e2
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
call fcn.00430af0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], 3
jmp 0x435230
call sub.KERNEL32.dll_GetLastError
mov dword [ebx], 1
mov dword [ebx + 8], eax
mov dword [ebx + 4], 0
jmp 0x435230
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp - 0x28]
mov dword [ecx], 1
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
push esi
call sub.KERNEL32.dll_CloseHandle
push edi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x14
mov edx, 4
call fcn.0040dcf0
ud2
Function at 0x4027a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54129f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push 0x5d9178
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x402950
call fcn.0053ffba
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0xc]
push ecx
push 2
lea eax, [esp + 0xc]
push 0x44a
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], eax
call dword [0x553d48]
mov esi, dword [esp + 0x28]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.0053ffb4
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x20], 0
call fcn.0053feb8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x4027b8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54129f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push 0x5d9178
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x402950
call fcn.0053ffba
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0xc]
push ecx
push 2
lea eax, [esp + 0xc]
push 0x44a
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], eax
call dword [0x553d48]
mov esi, dword [esp + 0x28]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.0053ffb4
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x20], 0
call fcn.0053feb8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4