joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71be70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x48f253
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00745f6a
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x67d618
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x67c258
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4910b4]
push eax
mov ecx, edi
call fcn.0074b6dc
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0074cc34
test eax, eax
je 0x71bf8c
mov ecx, dword [esp + 0x3c]
call fcn.0074b709
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x491570]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x71bf50
push edi
mov ecx, esi
call fcn.00748ccf
mov ecx, esi
call fcn.0071c0f0
cmp dword [esp + 0x38], 1
jne 0x71bf85
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00748e39
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x71e9a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x71e9d3
push esi
call fcn.00721a90
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x71e9cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x71ea59
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x71ea42
mov eax, dword [esi + 8]
test eax, eax
je 0x71e9f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x71ea3e
cmp eax, 2
je 0x71ea42
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x71e9ea
cmp eax, 3
je 0x71ea1d
cmp eax, 1
jne 0x71e9ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x71e9ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x71e9ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0071ea80
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x71ea68
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0071ea80
add esp, 4
pop esi
ret
Function at 0x401360
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x492a80]
test eax, eax
je 0x40139a
mov eax, dword [eax]
push eax
call fcn.004033f0
mov ecx, dword [0x492a80]
mov dword [ecx], eax
mov edx, dword [0x492a80]
mov eax, dword [edx + 0x94]
push eax
call fcn.004033f0
mov ecx, dword [0x492a80]
add esp, 8
mov dword [ecx + 0x94], eax
call fcn.00402ed0
mov eax, dword [0x492a84]
test eax, eax
je 0x4013b6
push fcn.00412540
push eax
call fcn.0040b850
add esp, 8
mov edx, dword [0x492a80]
mov eax, dword [edx + 0x24]
test eax, eax
je 0x40140f
call fcn.004065a0
call fcn.0043be00
call fcn.00404ac0
call fcn.00421a50
call fcn.004040d0
call fcn.00403f20
call fcn.00403cf0
mov eax, dword [0x492a80]
push eax
call fcn.00401ef0
mov ecx, dword [0x492a80]
push ecx
call fcn.00402cc0
add esp, 8
mov dword [0x492a80], 0
call fcn.00403dd0
mov edx, dword [esp + 4]
push edx
call dword [0x4781e0]
int3
Function at 0x402420
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov edi, eax
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [edi + 4]
push ecx
push edx
call fcn.0041cb00
add esp, 4
push eax
push str._nWirelisting_project__s_into_file__s_._._.
call fcn.00403070
mov esi, dword [edi]
add esp, 0xc
call fcn.00401fa0
call fcn.00409540
mov eax, dword [edi + 0x30]
test eax, eax
jne 0x40245d
mov esi, dword [edi]
call fcn.004020b0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x402474
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x402474
push edi
call fcn.00404970
add esp, 4
mov eax, dword [edi + 4]
push edi
push 0x408db0
push 0
push eax
mov dword [edi + 0x44], 0
call fcn.004091d0
push str.VSM_SCAN_COMPONENTS
call dword [0x4781d4]
add esp, 0x14
test eax, eax
jne 0x4024aa
mov ecx, dword [edi + 4]
push ecx
call fcn.004022c0
add esp, 4
mov edx, dword [edi + 4]
push edi
push 0x406fe0
push 0
push edx
mov dword [edi + 0x50], 0
call fcn.00409100
mov eax, dword [edi + 4]
push edi
push 0x407df0
push 0
push eax
mov dword [edi + 0x50], 0
call fcn.00409100
mov ecx, dword [edi + 4]
push edi
push ecx
call fcn.00407e70
mov eax, dword [edi + 0x1c]
add esp, 0x28
test eax, eax
je 0x4024f7
push edi
call fcn.00408480
add esp, 4
mov esi, dword [edi]
test esi, esi
je 0x402529
mov eax, dword [esi + 8]
test eax, eax
je 0x402515
cmp eax, 1
je 0x402515
cmp eax, 2
jne 0x402529
push 0x4785a4
jmp 0x40251a
push 0x4785a0
push esi
call fcn.00403550
push esi
call fcn.00403520
add esp, 0xc
call fcn.00406670
mov esi, edi
call fcn.00402200
pop edi
xor eax, eax
pop esi
ret

Function at 0x40b040
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push eax
push 0
call fcn.0040ace0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add esp, 8
cmp eax, 0xffffffff
push esi
push ecx
push edx
jne 0x40b072
mov eax, dword [esp + 0x14]
push eax
call dword [0x478194]
add esp, 0x10
pop esi
ret
mov ecx, dword [esp + 0x14]
imul eax, eax, 0x3c
push ecx
call dword [eax + 0x497f40]
add esp, 0x10
pop esi
ret
Function at 0x40e9b0
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x24
push esi
push eax
call fcn.0040c240
add esp, 4
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e9c6
sub eax, edx
cmp eax, 0xff
jb 0x40e9e9
push esi
call fcn.0040c170
add esp, 4
mov eax, 2
pop esi
add esp, 0x24
ret
push edi
mov edi, dword [esp + 0x34]
cmp edi, 2
jne 0x40ea1d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e9f8
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
jne 0x40ea1d
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ea10
sub eax, edx
mov byte [eax + esi - 1], cl
lea ecx, [esp + 8]
push ecx
push esi
call dword [0x47821c]
add esp, 8
test eax, eax
je 0x40ea58
push esi
call fcn.0040c170
add esp, 4
call dword [0x4780c0]
mov edi, dword [eax]
xor edx, edx
cmp edi, 0xd
setne dl
pop edi
pop esi
dec edx
and edx, 3
add edx, 4
mov eax, edx
add esp, 0x24
ret
mov eax, dword [esp + 0xe]
test ah, 0x40
jne 0x40ea79
test al, al
js 0x40ea79
push esi
call fcn.0040c170
add esp, 4
pop edi
mov eax, 7
pop esi
add esp, 0x24
ret
cmp edi, 3
push ebp
jne 0x40ea8d
push esi
call dword [0x478218]
add esp, 4
mov ebp, eax
jmp 0x40eae1
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ea92
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
jne 0x40eabb
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40eaa7
sub eax, edx
mov byte [eax + esi - 1], cl
mov edi, 1
jmp 0x40eabd
xor edi, edi
push esi
call dword [0x4780bc]
add esp, 4
test edi, edi
mov ebp, eax
je 0x40eae1
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ead0
mov ax, word [0x479520]
mov word [edi], ax
push esi
call fcn.0040c170
add esp, 4
test ebp, ebp
pop ebp
jne 0x40eaf7
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret
call dword [0x4780c0]
mov edi, dword [eax]
xor ecx, ecx
cmp edi, 0xd
setne cl
pop edi
pop esi
dec ecx
and ecx, 3
add ecx, 4
mov eax, ecx
add esp, 0x24
ret

Function at 0x412b60
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push esi
call fcn.00418820
push eax
push str._n_Fatal_error_encountered__n_s_n
call fcn.00413b20
push esi
call fcn.004186c0
add esp, 0x14
cmp eax, 5
pop esi
mov dword [esp + 4], 1
je 0x412b97
mov dword [esp + 4], 0
jmp fcn.00413840
Function at 0x413840
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x49a81c]
test eax, eax
jne 0x413859
mov dword [0x49a81c], 1
call dword [0x48b1c0]
push esi
mov esi, dword [0x49a820]
test esi, esi
je 0x41386d
call dword [esi + 4]
mov esi, dword [esi]
test esi, esi
jne 0x413864
mov eax, dword [esp + 8]
pop esi
mov dword [esp + 4], 3
jmp 0x413a90
sub esp, 0x44
mov eax, dword [0x48c320]
xor eax, esp
push 0
mov dword [esp + 0x44], eax
call dword [0x478020]
push 0x40
lea eax, [esp + 4]
push eax
call dword [0x47801c]
call dword [0x478050]
test eax, eax
jne 0x413ae0
mov ecx, dword [0x4781c0]
add ecx, 0x40
push str.Abnormal_program_termination_n
push ecx
call dword [0x4781bc]
mov edx, dword [esp + 0x50]
add esp, 8
push edx
call dword [0x4781e0]
push 0x2010
push 0
push str.Abnormal_program_termination
push 0
call dword [0x478270]
mov eax, dword [esp + 0x48]
push eax
call dword [0x478030]
push eax
call dword [0x47802c]
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0041bfa5
add esp, 0x44
ret

Function at 0x413b20
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1ff4
call fcn.0041bf30
mov eax, dword [0x48c320]
xor eax, esp
push 0
mov dword [esp + 0x1ff4], eax
call dword [0x478020]
push 0x40
lea eax, [esp + 0x14]
push eax
call dword [0x47801c]
call dword [0x478050]
test eax, eax
jne 0x413b97
mov eax, dword [0x49d6f4]
test eax, eax
jne 0x413b68
mov eax, dword [0x4781c0]
add eax, 0x40
mov edx, dword [esp + 0x1ff8]
lea ecx, [esp + 0x1ffc]
push ecx
push edx
push eax
call dword [0x478104]
add esp, 0xc
mov ecx, dword [esp + 0x1ff0]
xor ecx, esp
call fcn.0041bfa5
add esp, 0x1ff4
ret
mov ecx, dword [esp + 0x1ff8]
push esi
lea eax, [esp + 0x2000]
push eax
push ecx
lea edx, [esp + 0x5c]
push edx
call dword [0x478100]
mov esi, dword [0x4781d4]
push str.VL_ERROR_CONSOLE
call esi
add esp, 0x10
test eax, eax
je 0x413c19
push edi
call dword [0x478028]
mov esi, dword [0x478058]
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff4
mov edi, eax
call esi
lea eax, [esp + 0x58]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413be5
push 0
lea ecx, [esp + 0x18]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x64]
push edx
push edi
call dword [0x478024]
pop edi
pop esi
mov ecx, dword [esp + 0x1ff0]
xor ecx, esp
call fcn.0041bfa5
add esp, 0x1ff4
ret
push str.VL_ERROR_IO
call esi
add esp, 4
test eax, eax
je 0x413c83
push str.I_O_Window
push 0
call dword [0x478278]
test eax, eax
je 0x413c97
lea ecx, [esp + 0x54]
mov dword [esp + 4], 0x1644
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x413c47
lea edx, [esp + 4]
push edx
sub ecx, esi
inc ecx
push 0
mov dword [esp + 0x10], ecx
push 0x4a
lea ecx, [esp + 0x60]
push eax
mov dword [esp + 0x1c], ecx
call dword [0x478274]
pop esi
mov ecx, dword [esp + 0x1ff0]
xor ecx, esp
call fcn.0041bfa5
add esp, 0x1ff4
ret
push 0x2010
push 0
lea eax, [esp + 0x5c]
push eax
push 0
call dword [0x478270]
mov ecx, dword [esp + 0x1ff4]
pop esi
xor ecx, esp
call fcn.0041bfa5
add esp, 0x1ff4
ret
Function at 0x41ba20
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
mov eax, dword [0x48c320]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ba40
sub eax, edx
cmp eax, 1
jae 0x41ba66
or eax, 0xffffffff
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0041bfa5
add esp, 0x104
ret
mov eax, esi
lea edx, [eax + 1]
jmp 0x41ba70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ba70
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
jne 0x41ba92
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ba85
sub eax, edx
mov byte [eax + esi - 1], cl
push esi
call dword [0x47812c]
push 2
push esi
call fcn.00413e80
add esp, 0xc
test eax, eax
jne 0x41babd
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0041bfa5
add esp, 0x104
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41bac2
sub eax, edx
cmp eax, 0xe
jbe 0x41bb04
push 0xe
lea eax, [esp + 4]
push esi
push eax
call dword [0x47819c]
lea ecx, [esp + 0xc]
push 2
push ecx
mov byte [esp + 0x22], 0
call fcn.00413e80
add esp, 0x14
test eax, eax
jne 0x41bb04
lea edx, [esp]
push 2
push edx
call fcn.0040e9b0
add esp, 8
mov ecx, dword [esp + 0x100]
xor ecx, esp
mov eax, 7
call fcn.0041bfa5
add esp, 0x104
ret

Function at 0x41bc50
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 3
push esi
call fcn.0040e9b0
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [0x478130]
add esp, 0x10
test eax, eax
jne 0x41bc72
pop esi
ret
mov esi, dword [0x4780c0]
call esi
cmp dword [eax], 0xd
jne 0x41bc86
mov eax, 7
pop esi
ret
call esi
mov edx, dword [eax]
xor ecx, ecx
cmp edx, 2
sete cl
pop esi
lea ecx, [ecx + ecx + 2]
mov eax, ecx
ret
Function at 0x41d020
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x49dcc0]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x41d033
mov eax, 1
pop ebx
ret
push ebp
mov ebp, 1
mov dword [0x49dcc0], ebp
call fcn.00423150
push ebx
call fcn.0041c760
push 3
call fcn.004287c0
mov cx, word [0x47aaf0]
mov dword [0x49dc7c], eax
mov word [eax], cx
mov dl, byte [0x47aaf2]
push 2
mov byte [eax + 2], dl
call fcn.004287c0
mov dword [0x49dc80], eax
push 0x200
mov word [eax], 0x20
call fcn.0040c460
push 0x200
mov dword [0x4a4a60], eax
call fcn.0040c460
push 0x200
mov dword [0x4a4a44], eax
call fcn.0040c460
mov dword [0x4a4a54], eax
mov dword [0x49dc88], ebx
mov dword [0x49dcc8], ebx
mov dword [0x49dce4], ebx
mov dword [0x49dcb0], ebx
mov dword [0x49dcd4], ebx
mov dword [0x49dcd8], ebx
call fcn.004294a0
push 0x47aaec
mov dword [0x4a4a64], ebx
mov dword [0x4a4a68], ebx
mov dword [0x4a4a4c], ebx
mov dword [0x4a4a5c], ebx
mov dword [0x49dcac], ebx
mov dword [0x49dcb4], ebx
mov dword [0x49dcb8], ebp
mov dword [0x49dcbc], ebx
mov dword [0x49dcdc], ebx
mov dword [0x4a0bc8], ebx
call fcn.004396a0
call fcn.0041fe20
call fcn.0041fba0
mov eax, dword [0x4781c0]
add eax, 0x20
push eax
call fcn.00426200
push 0x2000
call fcn.00428800
mov ecx, dword [0x4781c0]
push ebx
add ecx, 0x20
push ecx
push 7
mov dword [0x49dc74], eax
mov dword [0x49dccc], ebx
mov word [0x4a4a50], bp
mov word [0x4a4a58], bp
call fcn.00421c20
call fcn.00421f40
call fcn.0041c500
push ebx
push 0x47aae8
push ebp
call fcn.00437cb0
add esp, 0x3c
cmp eax, ebx
je 0x41d1ac
cmp eax, 0x46
je 0x41d1ac
push eax
push 0x1a1
push 4
mov dword [0x49dcc0], ebx
call fcn.00421ed0
push 0x1a5
push 4
call fcn.00421ed0
add esp, 0x14
pop ebp
xor eax, eax
pop ebx
ret
call fcn.0041ccf0
test eax, eax
jne 0x41d1cf
push 0x1a5
push 4
mov dword [0x49dcc0], ebx
call fcn.00421ed0
add esp, 8
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.00428ff0
push str.VFPDIRCACHE
call dword [0x4781d4]
add esp, 8
cmp eax, ebx
mov dword [0x49dc38], eax
je 0x41d20b
push esi
push edi
mov edi, 0x4789f0
mov esi, eax
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
jne 0x41d20b
push ebp
call fcn.0041c5a0
add esp, 4
call fcn.00423bb0
test eax, eax
jne 0x41d23a
push 0x1a6
push 4
mov dword [0x49dcc0], ebx
call fcn.00421ed0
push 0x1a5
push 4
call fcn.00421ed0
add esp, 0x10
pop ebp
xor eax, eax
pop ebx
ret
mov dword [0x49dcd0], ebx
call fcn.00428ad0
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x41f350
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x49dd48]
sub esp, 0x100
push ebx
push edi
push eax
call fcn.0040c240
mov ebx, eax
push str._USERNAME_prefs.ini
push ebx
call fcn.0040bb60
add esp, 0xc
test eax, eax
je 0x41f3ff
push str.USERNAME
call dword [0x4781d4]
push eax
call fcn.0040c240
mov edi, eax
add esp, 8
test edi, edi
je 0x41f40e
push esi
push edi
call fcn.0040c240
push eax
call fcn.0040be90
push str._prefs.ini
push eax
call fcn.0040c1d0
lea ecx, [esp + 0x1c]
mov esi, eax
push ecx
push esi
call fcn.0040fe90
add esp, 0x18
test eax, eax
jne 0x41f3dd
lea edx, [esp + 0xc]
push edx
call fcn.0040c240
mov dword [0x49dd48], eax
lea eax, [esp + 0x10]
push eax
call fcn.0041eff0
add esp, 8
push esi
call fcn.0040c170
push edi
call fcn.0040c170
add esp, 8
pop esi
push ebx
call fcn.0040c170
add esp, 4
pop edi
pop ebx
add esp, 0x100
ret
mov ecx, dword [0x49dd48]
push ecx
call fcn.0041eff0
add esp, 4
push ebx
call fcn.0040c170
add esp, 4
pop edi
pop ebx
add esp, 0x100
ret

Function at 0x428870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push str.Vbase:i_mkblock__
push 0x10
mov edi, eax
call fcn.0040f470
mov esi, eax
add esp, 8
test esi, esi
jne 0x4288ab
mov eax, dword [0x4781c0]
add eax, 0x40
push str._n_n_Out_of_Memory__n
push eax
call dword [0x4781bc]
push esi
call fcn.00413840
add esp, 0xc
cmp edi, ebx
jb 0x4288df
nop
push str.Vbase:i_mkblock__
push edi
call fcn.0040f470
add esp, 8
test eax, eax
jne 0x4288ca
shr edi, 1
cmp edi, ebx
jae 0x4288b0
jmp 0x4288db
mov dword [esi + 0xc], edi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 4]
mov dword [esi], ecx
mov dword [ebp + 4], esi
test eax, eax
jne 0x428907
mov edx, dword [0x4781c0]
add edx, 0x40
push str._n_n_Out_of_Memory__n
push edx
call dword [0x4781bc]
add esp, 8
pop edi
pop esi
pop ebp
mov dword [esp + 4], 0
jmp fcn.00413840
pop edi
pop esi
pop ebp
ret
Function at 0x4370d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x4a12a0]
test eax, eax
je 0x4370fa
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4370fa
cmp dword [eax], 4
jne 0x4370fa
mov eax, dword [eax + 0x3c]
cmp dword [eax], 2
jne 0x4370fa
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
jmp fcn.0040b040
xor eax, eax
ret
Function at 0x44ce90
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4c
push ebx
push esi
push edi
mov edi, dword [0x4781dc]
mov esi, eax
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
lea eax, [esp + 0x28]
push 0x478e44
push eax
xor ebx, ebx
mov dword [esp + 0x20], 0x209
call edi
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x22c]
push edx
lea eax, [esp + 0x28]
push eax
push 0x80000002
call dword [0x478004]
test eax, eax
jne 0x44d0b9
mov ecx, dword [esp + 0x10]
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
lea edx, [esp + 0x28]
push 0x478e44
push edx
mov ebx, 1
mov byte [esp + ecx + 0x238], al
call edi
xor eax, eax
add esp, 0x10
mov ecx, 0x28a
lea edi, [esp + 0x430]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0x80000002
mov dword [esp + 0x24], 0xa28
call dword [0x47800c]
test eax, eax
jne 0x44d0b9
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Path
push edx
call dword [0x478008]
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x228]
mov edx, ebx
mov ecx, eax
sub edx, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x44cf80
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44cfcc
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44cf94
mov dx, word [0x478510]
mov word [edi], dx
mov eax, ecx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x44cfa8
sub eax, ecx
dec ebx
mov esi, ecx
mov edi, ebx
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x44cfb6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x430]
test al, al
je 0x44d0a2
push 0x479b90
call dword [0x4781d4]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44d0a2
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44cff6
sub eax, edx
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00474d24
add esi, 0xa29
push esi
mov edi, eax
call fcn.00474d24
mov edx, edi
add esp, 8
mov dword [esp + 0xc], eax
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x44d025
mov esi, dword [0x478250]
push 0x479b84
push edi
call esi
add esp, 8
test eax, eax
je 0x44d06a
push eax
lea ecx, [esp + 0x434]
push ecx
call dword [0x478210]
add esp, 8
test eax, eax
je 0x44d08f
push 0x479b84
push 0
call esi
add esp, 8
test eax, eax
jne 0x44d044
mov esi, dword [esp + 0xc]
push ebx
lea edx, [esp + 0x434]
push edx
push str.PATH_s__s
push esi
call dword [0x4781dc]
push esi
call dword [0x4781d0]
add esp, 0x14
jmp 0x44d093
mov esi, dword [esp + 0xc]
push edi
call fcn.00474d2a
push esi
call fcn.00474d2a
add esp, 8
mov eax, dword [esp + 0x14]
push eax
call dword [section..rdata]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d490
Capabilities:
Terminate process

Disassembly:
push str..listpkt.c
push 0xc
call fcn.0040f470
add esp, 8
test eax, eax
jne 0x44d4b9
push str.Unable_to_allocate_memory__n
call dword [0x4781a8]
add esp, 4
push 0
call dword [0x4781e0]
mov ecx, dword [esp + 4]
inc dword [ecx + 0xc]
mov edx, dword [esp + 8]
mov dword [eax], 0
mov dword [eax + 8], edx
mov edx, dword [ecx + 4]
test edx, edx
jne 0x44d4dd
mov dword [ecx], eax
mov dword [eax + 4], edx
mov dword [ecx + 4], eax
ret
mov dword [edx], eax
mov dword [eax + 4], edx
mov dword [ecx + 4], eax
ret
Function at 0x453510
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x100
test eax, eax
jne 0x45352a
mov eax, 0xc
add esp, 0x100
ret
mov ecx, dword [esp + 0x108]
cmp ecx, 2
jne 0x4535c0
push 0xfe
push eax
lea eax, [esp + 8]
push eax
call dword [0x47819c]
lea eax, [esp + 0xc]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x453555
sub eax, edx
cmp byte [esp + eax - 1], 0x5c
jne 0x45357d
lea eax, [esp]
lea edx, [eax + 1]
jmp 0x453570
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x453570
sub eax, edx
mov byte [esp + eax - 1], cl
lea ecx, [esp]
push 2
push ecx
call fcn.00413e80
add esp, 8
test eax, eax
je 0x4535ea
lea edx, [esp]
push edx
call dword [0x47812c]
add esp, 4
test eax, eax
je 0x4535ea
call dword [0x4780c0]
mov edx, dword [eax]
xor ecx, ecx
cmp edx, 2
setne cl
dec ecx
and ecx, 6
add ecx, 7
mov eax, ecx
add esp, 0x100
ret
cmp ecx, 3
jne 0x4535ff
mov edx, dword [0x48c868]
push edx
push 0x500
push eax
call dword [0x478208]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4535f3
push eax
call dword [0x478204]
add esp, 4
xor eax, eax
add esp, 0x100
ret
mov eax, 7
add esp, 0x100
ret
mov eax, 2
add esp, 0x100
ret

Function at 0x453bd0
Capabilities:
Query environment variable

Disassembly:
call fcn.00419280
test eax, eax
je 0x453c30
push esi
mov esi, dword [0x4781d4]
push str.USERID
call esi
add esp, 4
test eax, eax
je 0x453c11
push str.USERID
call esi
add esp, 4
mov edx, 0x4a27b0
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x453c00
pop esi
mov eax, 0x4a27b0
ret
mov eax, dword [str.65535]
mov cx, word [0x47f444]
mov dword [0x4a27b0], eax
mov word [0x4a27b4], cx
pop esi
mov eax, 0x4a27b0
ret
call fcn.00471120
push eax
push 0x478438
push 0x4a27b0
call dword [0x4781dc]
add esp, 0xc
mov eax, 0x4a27b0
ret

Function at 0x453c50
Capabilities:
Query environment variable

Disassembly:
call fcn.00419280
test eax, eax
je 0x453cbc
push esi
mov esi, dword [0x4781d4]
push str.HOSTNAME
call esi
add esp, 4
test eax, eax
je 0x453c91
push str.HOSTNAME
call esi
add esp, 4
mov edx, 0x4a29f0
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x453c80
pop esi
mov eax, 0x4a29f0
ret
mov eax, dword [str.localHost]
mov ecx, dword [0x47f44c]
mov dx, word [0x47f450]
mov dword [0x4a29f0], eax
mov dword [0x4a29f4], ecx
mov word [0x4a29f8], dx
pop esi
mov eax, 0x4a29f0
ret
call fcn.004712c0
mov edx, 0x4a29f0
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x453cc6
mov eax, 0x4a29f0
ret