joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408b20
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4373aa
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xac
mov eax, dword [0x446f30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00404780
mov dword [ebp - 0x94], eax
push 0x80
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp + 8]
call fcn.00404780
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x408d09
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x408be0
mov byte [ebp - 0x5d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404760
mov al, byte [ebp - 0x5d]
jmp 0x408e30
push 0x43a3b4
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x7c]
push ecx
call fcn.00405df0
add esp, 0xc
mov dword [ebp - 0x9c], eax
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.00405df0
add esp, 0xc
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7c]
call fcn.00404760
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x34]
call fcn.00404780
mov dword [ebp - 0xa8], eax
push 0
push 0x142
mov ecx, dword [ebp - 0xa8]
push ecx
call fcn.0041a027
mov dword [ebp - 0xac], eax
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 4
jne 0x408cca
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x84], esp
lea eax, [ebp + 8]
push eax
call fcn.00404720
mov dword [ebp - 0xb0], eax
call fcn.00408b20
add esp, 0x1c
mov byte [ebp - 0xb1], al
mov cl, byte [ebp - 0xb1]
mov byte [ebp - 0x7d], cl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00404760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404760
mov al, byte [ebp - 0x7d]
jmp 0x408e30
cmp dword [ebp - 0x38], 3
jne 0x408cfd
mov byte [ebp - 0x85], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00404760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404760
mov al, byte [ebp - 0x85]
jmp 0x408e30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00404760
jmp 0x408ddb
mov dword [ebp - 4], 0
jmp 0x408dfb
jmp 0x408e14
mov byte [ebp - 0x8e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404760
mov al, byte [ebp - 0x8e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00421364
mov esp, ebp
pop ebp
ret
Function at 0x409380
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43748f
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x446f30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00404720
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00403ec0
sub eax, 1
push eax
lea ecx, [ebp - 0x48]
call fcn.00403e90
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x4093e8
push 0x43a3d0
lea ecx, [ebp - 0x48]
call fcn.00403e40
push 0x43a3d4
lea ecx, [ebp - 0x48]
call fcn.00403e40
lea ecx, [ebp - 0x2c]
call fcn.0041c94d
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x48]
call fcn.00404780
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041c9e2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x409514
lea ecx, [ebp - 0x2c]
call fcn.0041c651
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x2c]
call fcn.0040b840
test eax, eax
je 0x4094b2
lea ecx, [ebp - 0x2c]
call fcn.0041c912
test eax, eax
jne 0x4094b2
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0041cb90
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x64]
call fcn.00405d80
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.004046e0
mov dword [ebp - 0x68], eax
call fcn.00409380
add esp, 0x1c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call fcn.00405ea0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0041cb90
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
call fcn.00401ce0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [ebp - 0x54]
call fcn.00405ea0
jmp 0x40950f
lea ecx, [ebp - 0x2c]
call fcn.0041c912
test eax, eax
jne 0x40950f
push 0x80
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0041cb90
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
call fcn.00401ce0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x58]
call fcn.00405ea0
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041cb90
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
call fcn.00401ce0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x5c]
call fcn.00405ea0
jmp 0x409417
lea ecx, [ebp - 0x2c]
call fcn.0041c56b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0041c973
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00404760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421364
mov esp, ebp
pop ebp
ret
Function at 0x411c7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x411cc4
call fcn.00419d4b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x411cc4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x411ce0
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004117f7
mov esi, eax
test edi, edi
je 0x411cde
test ebx, ebx
je 0x411cde
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x417987
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4179ab
cmp dword [edi + 0x54], 0
jne 0x4179ab
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00419d4b
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00417948
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x421364
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x446f30]
jne 0x42136e
repz ret
jmp fcn.004273ac
Function at 0x4320b4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00426d99
and dword [ebp - 4], 0
cmp dword [0x44ac28], 0
mov ebx, eax
jne 0x432165
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x432216
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43eb7c
push edi
call esi
test eax, eax
je 0x432216
push eax
call fcn.00426d27
mov dword [esp], 0x43eb6c
push edi
mov dword [0x44ac28], eax
call esi
push eax
call fcn.00426d27
mov dword [esp], 0x43eb58
push edi
mov dword [0x44ac2c], eax
call esi
push eax
call fcn.00426d27
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44ac30], eax
call esi
push eax
call fcn.00426d27
pop ecx
mov dword [0x44ac38], eax
test eax, eax
je 0x432165
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00426d27
pop ecx
mov dword [0x44ac34], eax
mov eax, dword [0x44ac34]
cmp eax, ebx
je 0x4321bd
cmp dword [0x44ac38], ebx
je 0x4321bd
push eax
call fcn.00426da2
push dword [0x44ac38]
mov esi, eax
call fcn.00426da2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4321bd
test edi, edi
je 0x4321bd
call esi
test eax, eax
je 0x4321b4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4321b4
test byte [ebp - 0xc], 1
jne 0x4321bd
or dword [ebp + 0x10], 0x200000
jmp 0x4321f6
mov eax, dword [0x44ac2c]
cmp eax, ebx
je 0x4321f6
push eax
call fcn.00426da2
pop ecx
test eax, eax
je 0x4321f6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4321f6
mov eax, dword [0x44ac30]
cmp eax, ebx
je 0x4321f6
push eax
call fcn.00426da2
pop ecx
test eax, eax
je 0x4321f6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44ac28]
call fcn.00426da2
pop ecx
test eax, eax
je 0x432216
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x432218
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40255d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40259c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40259c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40259c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40259c
cmp dword [ecx + 0x74], 0xe
jbe 0x40259c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4080bb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408158
push ebx
push esi
call fcn.00408084
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407fcd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408105
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408157
push edi
push eax
call fcn.00406a9b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408125
call fcn.00406bf6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408156
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407fcd
add esp, 0x20
test eax, eax
jne 0x408144
push edi
call fcn.00406bf6
jmp 0x40814c
push ebx
call fcn.00406bf6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x409350
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4110b0
push 0x4110a8
push str.FlsAlloc
push 0x1e
call fcn.00409211
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409384
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f114]
call esi
jmp 0x40938a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4093ce
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4110c0
push 0x4110b8
push str.FlsGetValue
push 0x20
call fcn.00409211
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409405
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f114]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x42e5ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x298]
mov esi, ecx
cmp eax, 3
je 0x42e5c2
test eax, eax
mov ecx, esi
je 0x42e5c8
pop esi
ret
lea ecx, [esi + 0x190]
call fcn.0042d03d
add esi, 0x100
mov ecx, esi
pop esi
jmp fcn.0042feef

Function at 0x42e5db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x268]
mov esi, ecx
cmp eax, 3
je 0x42e5f2
test eax, eax
mov ecx, esi
je 0x42e5f8
pop esi
ret
lea ecx, [esi + 0x178]
call fcn.0042d00c
add esi, 0xe8
mov ecx, esi
pop esi
jmp fcn.0042feef

Function at 0x42e677
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42e6ad
cmp eax, 1
jne 0x42e6ab
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42e6ab
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42e6ab
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042e5db

Function at 0x42e6b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42e6e9
cmp eax, 1
jne 0x42e6e7
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42e6e7
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42e6e7
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042e5ab

Function at 0x42e710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x360]
mov esi, ecx
test eax, eax
je 0x42e73c
cmp eax, 3
jne 0x42e751
lea ecx, [esi + 0x238]
call fcn.0042dd4f
add esi, 0x1a8
mov ecx, esi
pop esi
jmp fcn.0042feef
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dd4f
pop esi
ret

Function at 0x42e753
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x300]
mov esi, ecx
test eax, eax
je 0x42e788
cmp eax, 3
jne 0x42e798
cmp byte [esi + 0x2e8], 0
jne 0x42e77a
lea ecx, [esi + 0x208]
call fcn.0042d890
add esi, 0x178
mov ecx, esi
pop esi
jmp fcn.0042feef
mov ecx, esi
call fcn.0042feef
cmp byte [esi + 0x170], 0
je 0x42e79a
pop esi
ret
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042d890

Function at 0x42e7a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x12d0]
mov esi, ecx
test eax, eax
je 0x42e7d4
cmp eax, 3
jne 0x42e7e9
lea ecx, [esi + 0x9f0]
call fcn.0042dcd3
add esi, 0x960
mov ecx, esi
pop esi
jmp fcn.0042feef
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dcd3
pop esi
ret
Function at 0x42e7eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x310]
mov esi, ecx
test eax, eax
je 0x42e820
cmp eax, 3
jne 0x42e834
cmp byte [esi + 0x2f8], 0
jne 0x42e812
lea ecx, [esi + 0x218]
call fcn.0042d890
add esi, 0x180
mov ecx, esi
pop esi
jmp fcn.0042feef
lea ecx, [esi + 0xf0]
call fcn.0042feef
cmp byte [esi + 0xe8], 0
je 0x42e836
pop esi
ret
add esi, 8
mov ecx, esi
pop esi
jmp fcn.0042d890

Function at 0x42e884
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x8d0]
mov esi, ecx
test eax, eax
je 0x42e8b0
cmp eax, 3
jne 0x42e8c5
lea ecx, [esi + 0x4f0]
call fcn.0042dc58
add esi, 0x460
mov ecx, esi
pop esi
jmp fcn.0042feef
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dc58
pop esi
ret

Function at 0x42e8c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x360]
mov esi, ecx
test eax, eax
je 0x42e8f3
cmp eax, 3
jne 0x42e908
lea ecx, [esi + 0x238]
call fcn.0042dd2f
add esi, 0x1a8
mov ecx, esi
pop esi
jmp fcn.0042feef
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dd2f
pop esi
ret

Function at 0x42e90a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x3c0]
mov esi, ecx
test eax, eax
je 0x42e936
cmp eax, 3
jne 0x42e94b
lea ecx, [esi + 0x268]
call fcn.0042dcb3
add esi, 0x1d8
mov ecx, esi
pop esi
jmp fcn.0042feef
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dcb3
pop esi
ret

Function at 0x42e94d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0xd40]
mov esi, ecx
test eax, eax
je 0x42e96e
cmp eax, 3
jne 0x42e983
add esi, 0x460
mov ecx, esi
pop esi
jmp fcn.0042e884
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dc58
pop esi
ret

Function at 0x42e985
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x4a0]
mov esi, ecx
test eax, eax
je 0x42e9a6
cmp eax, 3
jne 0x42e9ba
add esi, 0x180
mov ecx, esi
pop esi
jmp fcn.0042e7eb
lea ecx, [esi + 0xf0]
call fcn.0042feef
cmp byte [esi + 0xe8], 0
je 0x42e9bc
pop esi
ret
add esi, 8
mov ecx, esi
pop esi
jmp fcn.0042d890

Function at 0x42e9c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x518]
mov esi, ecx
test eax, eax
je 0x42e9e8
cmp eax, 3
jne 0x42e9fd
add esi, 0x1a8
mov ecx, esi
pop esi
jmp fcn.0042e8c7
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dd2f
pop esi
ret

Function at 0x42e9ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x518]
mov esi, ecx
test eax, eax
je 0x42ea20
cmp eax, 3
jne 0x42ea35
add esi, 0x1a8
mov ecx, esi
pop esi
jmp fcn.0042e710
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dd4f
pop esi
ret
Function at 0x42ea37
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x488]
mov esi, ecx
test eax, eax
je 0x42ea58
cmp eax, 3
jne 0x42ea68
add esi, 0x178
mov ecx, esi
pop esi
jmp fcn.0042e753
mov ecx, esi
call fcn.0042feef
cmp byte [esi + 0x170], 0
je 0x42ea6a
pop esi
ret
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042d890

Function at 0x42ea78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x5a8]
mov esi, ecx
test eax, eax
je 0x42ea99
cmp eax, 3
jne 0x42eaae
add esi, 0x1d8
mov ecx, esi
pop esi
jmp fcn.0042e90a
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dcb3
pop esi
ret

Function at 0x42eab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x500]
mov esi, ecx
test eax, eax
je 0x42ead1
cmp eax, 3
jne 0x42eae6
add esi, 0x1a0
mov ecx, esi
pop esi
jmp fcn.0042e841
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dd0f
pop esi
ret

Function at 0x42eae8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x1c40]
mov esi, ecx
test eax, eax
je 0x42eb09
cmp eax, 3
jne 0x42eb1e
add esi, 0x960
mov ecx, esi
pop esi
jmp fcn.0042e7a8
mov ecx, esi
call fcn.0042feef
add esi, 0x90
mov ecx, esi
pop esi
jmp fcn.0042dcd3
pop esi
ret

Function at 0x42eb5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42eb92
cmp eax, 1
jne 0x42eb90
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42eb90
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42eb90
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042e9c7

Function at 0x42eb98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42ebce
cmp eax, 1
jne 0x42ebcc
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42ebcc
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42ebcc
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042e9ff

Function at 0x42ebd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx]
xor eax, eax
lea esi, [edx - 1]
cmp edx, 2
cmovae eax, esi
test eax, eax
je 0x42ec06
cmp eax, 1
jne 0x42ec04
mov eax, dword [ecx + 8]
or eax, dword [ecx + 0xc]
je 0x42ec04
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x42ec04
mov edx, dword [ecx + 0x14]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042e985
Function at 0x42ec0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42ec42
cmp eax, 1
jne 0x42ec40
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42ec40
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42ec40
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042e94d

Function at 0x42ec48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42ec7e
cmp eax, 1
jne 0x42ec7c
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42ec7c
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42ec7c
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042ea37

Function at 0x42ec84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42ecba
cmp eax, 1
jne 0x42ecb8
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42ecb8
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42ecb8
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042eab0

Function at 0x42ecc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42ecf6
cmp eax, 1
jne 0x42ecf4
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42ecf4
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42ecf4
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042ea78

Function at 0x42ecfc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov edx, dword [ecx + 8]
xor eax, eax
lea esi, [edx - 3]
add edx, 0xfffffffe
cmp esi, 2
cmovb eax, edx
test eax, eax
je 0x42ed32
cmp eax, 1
jne 0x42ed30
mov eax, dword [ecx + 0x10]
or eax, dword [ecx + 0x14]
je 0x42ed30
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42ed30
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call fcn.0042d8db
pop esi
ret
pop esi
jmp fcn.0042eae8

Function at 0x42feef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
cmp dword [ecx + 0x3c], 0
mov esi, ecx
je 0x42ff09
push dword [esi + 0x38]
push 0
push dword [0x8032a8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, esi
call fcn.00432091
mov eax, dword [esi + 0x44]
lock dec dword [eax]
jne 0x42ff20
mov ecx, dword [esi + 0x44]
call fcn.005ecb1a
mov eax, dword [esi + 0x48]
lock dec dword [eax]
jne 0x42ff30
mov ecx, dword [esi + 0x48]
call fcn.005ecf36
mov eax, dword [esi + 0x88]
lock dec dword [eax]
jne 0x42ff46
lea ecx, [esi + 0x88]
call fcn.005ed045
add esi, 0x50
mov ecx, esi
pop esi
jmp fcn.0042fed2
Function at 0x439244
Capabilities:
Accept command line arguments
Encode data using base64
Register raw input devices
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x13c0
call fcn.00649b30
mov esi, esp
mov dword [esi + 0x13a8], ebp
lea eax, [esi + 0x13b0]
mov dword [esi + 0xec], ecx
mov edi, dword [ebp + 8]
mov dword [esi + 0x74], edx
mov dword [esi + 0xd8], 0
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x6270c0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
call fcn.004392a0
Function at 0x4431dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x968
mov esi, esp
mov dword [esi + 0x950], ebp
call fcn.004431f8
Function at 0x44aa1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x23e0
call fcn.00649b30
mov edi, edx
call fcn.0044aa36