joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43be24
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test dword [esi + 0x2c], 0x400000
jne 0x43becb
push 4
push 0x10
mov edx, 0x8c00d0
call fcn.0043b7b8
pop ecx
pop ecx
test eax, eax
je 0x43be5b
mov ecx, eax
call fcn.00449d08
jmp 0x43bed0
push 8
xor ebx, ebx
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0051c010
mov edx, dword [ebp + 8]
add esp, 0xc
test edx, edx
je 0x43be86
lea eax, [ebp - 4]
push eax
push 2
pop ecx
call fcn.00449989
pop ecx
test eax, eax
je 0x43be90
jmp 0x43bed0
push ebx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 4], eax
mov eax, dword [edi + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
sub eax, ebx
je 0x43bea6
sub eax, 1
jne 0x43becb
push 0xc
jmp 0x43bea8
push 0xd
pop eax
push 8
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push dword [esi + 0x38]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x43bec7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x43be52
xor eax, eax
jmp 0x43bed0
mov eax, 0xfffff019
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43bed5
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [ebx + 0x2c]
mov edi, edx
and eax, 0x402000
cmp eax, 0x2000
je 0x43bf92
push 4
push 0x1c
mov edx, 0x8c00e0
call fcn.0043b7b8
pop ecx
pop ecx
test eax, eax
je 0x43bf1f
mov ecx, eax
call fcn.00449d08
jmp 0x43bf97
push 0x14
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0051c010
add esp, 0xc
test esi, esi
je 0x43bf4d
lea eax, [ebp - 0x34]
xor edx, edx
push eax
mov ecx, esi
call fcn.00439f9f
pop ecx
test eax, eax
jne 0x43bf92
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
jmp 0x43bf51
and dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
lea esi, [edi + 8]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub eax, 0
je 0x43bf6c
sub eax, 1
jne 0x43bf92
push 0xc
jmp 0x43bf6e
push 0xd
pop eax
push 0x14
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0x29
push dword [ebx + 0x38]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x43bf8e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x43bf16
xor eax, eax
jmp 0x43bf97
mov eax, 0xfffff019
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b034
leave
ret
Function at 0x43bfa6
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov ebp, edx
test dword [edi + 0x2c], 0x400000
jne 0x43c07a
push 4
push 0x10
pop esi
push esi
mov edx, 0x8c00d0
call fcn.0043b7b8
pop ecx
pop ecx
test eax, eax
je 0x43bff7
mov ecx, eax
call fcn.00449d08
jmp 0x43c07f
push 0xc
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0051c010
add esp, 0xc
test ebx, ebx
je 0x43c022
lea eax, [esp + 0x1c]
mov edx, ebx
push eax
push 2
pop ecx
call fcn.00449989
pop ecx
test eax, eax
je 0x43c02e
jmp 0x43c07f
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x30], 1
mov eax, dword [ebp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 4]
mov dword [esp + 0x18], eax
jne 0x43c04c
push 0xf
pop esi
jmp 0x43c053
cmp dword [esp + 0x30], 0
jne 0x43c07a
push 0xc
lea eax, [esp + 0x18]
push eax
push esi
push 0
push dword [edi + 0x38]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x43c076
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x43bfeb
xor eax, eax
jmp 0x43c07f
mov eax, 0xfffff019
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x14
ret

Function at 0x43c092
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x130
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x140]
mov ebx, edx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x144]
mov eax, dword [esi + 0x2c]
and eax, 0x402000
cmp eax, 0x2000
je 0x43c18e
push 4
push 0x1c
mov edx, 0x8c00e0
call fcn.0043b7b8
pop ecx
pop ecx
test eax, eax
je 0x43c0ef
mov ecx, eax
call fcn.00449d08
jmp 0x43c193
push pe_nt_image_headers32
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0051c010
add esp, 0xc
test edi, edi
je 0x43c124
lea eax, [esp + 0x14]
xor edx, edx
push eax
mov ecx, edi
call fcn.00439f9f
pop ecx
test eax, eax
jne 0x43c193
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
jmp 0x43c129
and dword [esp + 0x30], 0
push 0x1c
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.0051c650
push 0x1c
lea eax, [esp + 0xc8]
push ebp
push eax
call fcn.0051c650
add esp, 0x18
cmp dword [esp + 0x14c], 1
jne 0x43c157
push 0x2d
jmp 0x43c163
cmp dword [esp + 0x14c], 0
jne 0x43c18e
push 0x2e
pop eax
push pe_nt_image_headers32
lea ecx, [esp + 0x34]
push ecx
push eax
push 0x29
push dword [esi + 0x38]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x43c18a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x43c0e3
xor eax, eax
jmp 0x43c193
mov eax, 0xfffff019
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x130
ret
Function at 0x43c2ee
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x8c
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov esi, edx
lea eax, [esp + 0x10]
push 0x17
xor ebx, ebx
mov edi, ecx
pop ebp
test esi, esi
jne 0x43c352
push 0x80
push ebx
push eax
call fcn.0051c010
add esp, 0xc
test dword [edi + 0x2c], 0x400000
push 2
pop esi
je 0x43c340
mov ax, bp
mov dword [esp + 0x28], ebx
mov word [esp + 0x10], ax
jmp 0x43c39a
push ebx
mov word [esp + 0x14], si
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x14], eax
jmp 0x43c395
push eax
xor edx, edx
mov ecx, esi
call fcn.00439f62
pop ecx
test eax, eax
je 0x43c392
lea eax, [esp + 0x10]
xor edx, edx
push eax
mov ecx, esi
call fcn.00439f9f
pop ecx
test eax, eax
je 0x43c392
mov eax, 0xfffff019
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x8c
ret
push 2
pop esi
mov ax, word [esp + 0x10]
cmp dword [edi + 0x38], 0xffffffff
jne 0x43c3a7
mov eax, 0xfffff00d
jmp 0x43c379
cmp ax, si
jne 0x43c3d3
push 4
lea eax, [esp + 0x18]
push eax
push 9
push ebx
push dword [edi + 0x38]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x43c3e5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00449d08
jmp 0x43c379
cmp ax, bp
jne 0x43c3e9
push 4
lea eax, [esp + 0x2c]
push eax
push 9
push 0x29
jmp 0x43c3b6
xor eax, eax
jmp 0x43c379
call fcn.00529b17
int3

Function at 0x43c449
Capabilities:
Connect socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov eax, edx
push edi
mov dword [esp + 0xc], eax
lea edi, [ebp + 0x2c]
test dword [edi], 0x2000
mov ebx, edi
jne 0x43c4a1
cmp dword [esp + 0x14], 0x10
jne 0x43c470
mov edx, 0x8c00d0
jmp 0x43c47f
cmp dword [esp + 0x14], 0x1c
jne 0x43c4bb
mov edx, 0x8c00e0
lea ebx, [ebp + 0x2c]
push 0
push dword [esp + 0x18]
call fcn.0043b7b8
pop ecx
pop ecx
test eax, eax
je 0x43c49d
pop edi
pop ebp
mov ecx, eax
pop ebx
add esp, 4
jmp fcn.00449d08
mov eax, dword [esp + 0xc]
push dword [esp + 0x14]
push eax
push dword [ebp + 0x38]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x43c4c2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x43c490
mov eax, 0xfffff019
jmp 0x43c4cd
mov eax, dword [edi]
or eax, 0x2000000
mov dword [ebx], eax
xor eax, eax
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43c540
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0xa0]
mov ebp, edx
mov ebx, ecx
test edi, edi
je 0x43c57d
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.0044b036
test eax, eax
jne 0x43c60f
lea edi, [esp + 0x10]
xor eax, eax
cmp dword [ebx + 0x34], eax
je 0x43c58e
mov eax, 0xfffff008
jmp 0x43c60f
test dword [ebx + 0x2c], 0x2000
jne 0x43c5de
cmp dword [esp + 0xa4], 0x10
jne 0x43c5a8
mov edx, 0x8c00d0
jmp 0x43c5b7
cmp dword [esp + 0xa4], 0x1c
jne 0x43c5d5
mov edx, 0x8c00e0
push eax
push dword [esp + 0xa8]
mov ecx, ebx
call fcn.0043b7b8
pop ecx
pop ecx
test eax, eax
je 0x43c5dc
mov ecx, eax
call fcn.00449d08
jmp 0x43c60f
mov eax, 0xfffff019
jmp 0x43c60f
xor eax, eax
push eax
push eax
push dword [esp + 0xac]
push edi
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0xb4]
push ebp
push dword [ebx + 0x38]
call dword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x43c60b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x43c5cc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x94]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x8c
ret

Function at 0x43c6c3
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
mov eax, ecx
mov dword [esp + 8], eax
push esi
push edi
mov edi, edx
test eax, eax
je 0x43c7bb
test edi, edi
je 0x43c7bb
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
push ecx
push ecx
call ebp
mov ebx, eax
test ebx, ebx
jne 0x43c706
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
mov ecx, eax
pop ebx
add esp, 4
jmp fcn.00449d08
lea ecx, [ebx + ebx]
call fcn.004396f2
mov esi, eax
test esi, esi
jne 0x43c71e
mov eax, 0xfffff027
jmp 0x43c7c0
push esi
push ebx
call ebp
test eax, eax
jne 0x43c72f
mov ecx, esi
call fcn.00439702
jmp 0x43c6f2
xor ecx, ecx
cmp word [esi + eax*2 - 2], 0x5c
mov word [esi + eax*2], cx
jne 0x43c750
cmp eax, 3
jne 0x43c749
cmp word [esi + 2], 0x3a
je 0x43c750
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push 0xfde9
call ebp
mov ebx, eax
test ebx, ebx
je 0x43c726
mov eax, dword [edi]
cmp ebx, eax
jle 0x43c783
mov ecx, esi
call fcn.00439702
mov dword [edi], ebx
mov eax, 0xfffff024
jmp 0x43c7c0
mov ecx, bind
cmp eax, ecx
cmova eax, ecx
xor ecx, ecx
push ecx
push ecx
push eax
push dword [esp + 0x1c]
push 0xffffffffffffffff
push esi
push ecx
push 0xfde9
call ebp
mov ecx, esi
mov ebx, eax
call fcn.00439702
test ebx, ebx
je 0x43c6f2
lea eax, [ebx - 1]
mov dword [edi], eax
xor eax, eax
jmp 0x43c7c0
mov eax, 0xfffff019
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43c7c6
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
sub esp, 0xc
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x43c7e5
mov eax, 0xfffff019
jmp 0x43c90c
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push edi
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push 0xfde9
call ebp
mov edi, eax
test edi, edi
jne 0x43c814
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00449d08
jmp 0x43c90a
push esi
lea ecx, [edi + edi]
call fcn.004396f2
mov esi, eax
test esi, esi
jne 0x43c82d
mov eax, 0xfffff027
jmp 0x43c909
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call ebp
test eax, eax
je 0x43c84a
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x43c863
mov ecx, esi
call fcn.00439702
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00449d08
jmp 0x43c909
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
push edi
call ebp
mov ebx, eax
cmp ebx, edi
jbe 0x43c88c
mov ecx, esi
call fcn.00439702
lea ecx, [ebx + ebx]
call fcn.004396f2
mov esi, eax
test esi, esi
je 0x43c907
push esi
push ebx
call ebp
cmp word [esi + edi*2 - 2], 0x5c
push 0x3a
pop ebx
jne 0x43c8a9
cmp edi, 3
jne 0x43c8a2
cmp word [esi + 2], bx
je 0x43c8b4
dec edi
xor eax, eax
mov word [esi + edi*2], ax
cmp edi, 2
jb 0x43c900
cmp word [esi + 2], bx
jne 0x43c900
movzx ecx, word [esi]
push 0x19
pop edi
mov edx, ecx
lea eax, [ecx - 0x41]
cmp ax, di
ja 0x43c8c8
mov eax, ecx
jmp 0x43c8d6
lea eax, [edx - 0x61]
cmp ax, di
ja 0x43c900
lea eax, [ecx - 0x20]
movzx eax, ax
test ax, ax
je 0x43c900
push 0x3d
mov word [esp + 0x16], ax
xor eax, eax
pop ecx
mov word [esp + 0x16], ax
lea eax, [esp + 0x10]
push esi
push eax
mov word [esp + 0x18], cx
mov word [esp + 0x1c], bx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, esi
call fcn.00439702
xor eax, eax
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0xc]
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0xc
ret

Function at 0x43c91c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov ebx, eax
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x43c979
cmp dword [ebp - 0x128], ebx
je 0x43c97f
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x43c963
jmp 0x43c985
mov edi, dword [ebp - 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b034
leave
ret
Function at 0x43c99d
Capabilities:
Set console window title

Disassembly:
push ebx
push ebp
push esi
push edi
xor esi, esi
mov ebp, ecx
mov edi, esi
call fcn.00442ca6
push esi
push esi
push 0xffffffffffffffff
push ebp
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test ebx, ebx
jne 0x43c9cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x43ca35
lea ecx, [ebx + ebx]
call fcn.004396f2
mov edi, eax
test edi, edi
je 0x43ca47
push ebx
push edi
push 0xffffffffffffffff
push ebp
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x43c9c3
cmp eax, 0x2000
jle 0x43ca00
xor eax, eax
mov word [edi + 0x3ffe], ax
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
test eax, eax
je 0x43c9c3
mov ebx, 0x8934d0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x8934c4]
call fcn.00439702
mov ecx, ebp
call fcn.004396cb
push ebx
mov dword [0x8934c4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, edi
call fcn.00439702
pop edi
mov ecx, esi
pop esi
pop ebp
pop ebx
jmp fcn.00449d08
mov edx, str.uv__malloc
push 0xe
pop ecx
call fcn.00449c84
int3
Function at 0x43d46b
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
mov eax, ecx
mov dword [esp + 8], eax
push esi
push edi
mov edi, edx
test eax, eax
je 0x43d55b
test edi, edi
je 0x43d55b
xor eax, eax
cmp dword [edi], eax
je 0x43d55b
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push eax
call ebp
mov ebx, eax
test ebx, ebx
jne 0x43d4b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
mov ecx, eax
pop ebx
add esp, 4
jmp fcn.00449d08
inc ebx
lea ecx, [ebx + ebx]
call fcn.004396f2
mov esi, eax
test esi, esi
jne 0x43d4cf
mov eax, 0xfffff027
jmp 0x43d560
push esi
push ebx
call ebp
test eax, eax
jne 0x43d4e0
mov ecx, esi
call fcn.00439702
jmp 0x43d4a2
cmp word [esi + eax*2 - 2], 0x5c
jne 0x43d4fb
cmp eax, 3
jne 0x43d4f4
cmp word [esi + 2], 0x3a
je 0x43d4fb
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push 0xfde9
call ebp
mov ebx, eax
test ebx, ebx
je 0x43d4d7
cmp ebx, dword [edi]
jbe 0x43d52c
mov ecx, esi
call fcn.00439702
mov dword [edi], ebx
mov eax, 0xfffff024
jmp 0x43d560
xor eax, eax
push eax
push eax
push dword [edi]
push dword [esp + 0x1c]
push 0xffffffffffffffff
push esi
push eax
push 0xfde9
call ebp
mov ecx, esi
mov ebx, eax
call fcn.00439702
test ebx, ebx
je 0x43d4a2
lea eax, [ebx - 1]
mov dword [edi], eax
xor eax, eax
jmp 0x43d560
mov eax, 0xfffff019
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43d6a2
Capabilities:
Get common file path
Get session user name

Disassembly:
sub esp, 0x210
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, ecx
test esi, esi
jne 0x43d6c7
mov eax, 0xfffff019
jmp 0x43d818
lea eax, [esp + 4]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43d6f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00449d08
jmp 0x43d818
and dword [esp + 8], 0
lea eax, [esp + 8]
push ebx
push ebp
mov ebp, dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
push eax
push 0
push dword [esp + 0x14]
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
je 0x43d735
call ebx
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00449d08
jmp 0x43d816
mov eax, dword [esp + 0x10]
push edi
lea ecx, [eax + eax]
call fcn.004396f2
mov edi, eax
test edi, edi
jne 0x43d754
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43d7bb
lea eax, [esp + 0x14]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
jne 0x43d785
call ebx
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.00439702
mov ecx, esi
call fcn.00449d08
jmp 0x43d815
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x101
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x43d7c2
call ebx
mov ecx, edi
mov esi, eax
call fcn.00439702
cmp esi, 0x7a
jne 0x43d779
mov eax, 0xfffff027
jmp 0x43d815
lea ebx, [esi + 0x10]
or edx, 0xffffffff
and dword [ebx], 0
mov ecx, edi
push ebx
call fcn.0043d585
pop ecx
mov ecx, edi
mov ebp, eax
call fcn.00439702
test ebp, ebp
je 0x43d7e5
mov eax, ebp
jmp 0x43d815
and dword [esi], 0
lea ecx, [esp + 0x18]
push esi
or edx, 0xffffffff
call fcn.0043d585
mov edi, eax
pop ecx
test edi, edi
je 0x43d807
mov ecx, dword [ebx]
call fcn.00439702
mov eax, edi
jmp 0x43d815
and dword [esi + 0xc], 0
or dword [esi + 4], 0xffffffff
or dword [esi + 8], 0xffffffff
xor eax, eax
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
call fcn.0051b034
add esp, 0x210
ret
Function at 0x43d82e
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
mov eax, edx
xor ecx, ecx
mov dword [esp + 0xc], eax
push esi
mov dword [esp + 8], ebx
mov dword [ebx], ecx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
xor eax, eax
test esi, esi
je 0x43d921
push ebp
mov ebp, eax
push edi
mov edi, esi
mov dword [esp + 0x14], ebp
cmp word [esi], ax
je 0x43d883
xor ebx, ebx
push edi
call fcn.0052fd64
pop ecx
lea edi, [edi + eax*2]
add edi, 2
inc ebp
cmp word [edi], bx
jne 0x43d868
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x14], ebp
push 8
push ebp
call dword [0x603d40]
mov dword [ebx], eax
pop ecx
pop ecx
test eax, eax
jne 0x43d8a0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x43d954
xor eax, eax
mov ebp, esi
mov edi, eax
cmp word [esi], ax
je 0x43d910
cmp edi, dword [esp + 0x14]
jge 0x43d910
lea eax, [esp + 0x10]
or edx, 0xffffffff
push eax
mov ecx, ebp
call fcn.0043d585
pop ecx
test eax, eax
jne 0x43d927
mov eax, dword [esp + 0x10]
inc eax
push 0x3d
push eax
call fcn.0051c170
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x43d8e5
mov ecx, dword [esp + 0x10]
call fcn.00439702
jmp 0x43d8fa
mov ecx, dword [ebx]
xor eax, eax
mov byte [edx], al
mov eax, dword [esp + 0x10]
mov dword [ecx + edi*8], eax
lea eax, [edx + 1]
mov dword [ecx + edi*8 + 4], eax
inc edi
push ebp
call fcn.0052fd64
pop ecx
lea ebp, [ebp + eax*2]
xor eax, eax
add ebp, 2
cmp word [ebp], ax
jne 0x43d8ab
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [esp + 0x18]
mov dword [eax], edi
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
test edi, edi
jle 0x43d943
mov esi, edi
mov ecx, dword [ebx]
mov ecx, dword [ecx + esi*8]
call fcn.00439702
sub edi, 1
jne 0x43d934
mov ecx, dword [ebx]
call fcn.00439702
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov dword [ebx], ecx
mov dword [eax], ecx
mov eax, 0xfffff027
jmp 0x43d91f
Function at 0x43d95b
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x410
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, edx
mov dword [esp + 8], eax
push ebx
mov ebx, dword [esp + 0x418]
push esi
test ecx, ecx
je 0x43dab2
test eax, eax
je 0x43dab2
test ebx, ebx
je 0x43dab2
xor esi, esi
cmp dword [ebx], esi
je 0x43dab2
lea eax, [esp + 8]
push eax
call fcn.0043d616
pop ecx
test eax, eax
jne 0x43dab7
push ebp
push edi
push esi
lea edi, [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [esp + 0x10]
mov eax, edi
push 0x200
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 0x200
jmp 0x43da17
lea ecx, [esp + 0x1c]
cmp edi, ecx
je 0x43d9ed
mov ecx, edi
call fcn.00439702
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x10], eax
lea ecx, [eax + eax]
call fcn.004396f2
mov edi, eax
test edi, edi
je 0x43da41
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x10]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
jae 0x43d9da
mov ecx, ebp
call fcn.00439702
mov ebp, esi
cmp dword [esp + 0x14], esi
jne 0x43da48
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43da48
mov ecx, eax
call fcn.00449d08
mov esi, eax
jmp 0x43da9d
mov esi, 0xfffff027
jmp 0x43da92
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x43da67
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43da36
cmp eax, dword [ebx]
jbe 0x43da74
mov dword [ebx], eax
mov esi, 0xfffff024
jmp 0x43da9d
push esi
push esi
push dword [ebx]
push dword [esp + 0x24]
push 0xffffffffffffffff
push edi
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x43da5f
dec eax
mov dword [ebx], eax
test ebp, ebp
je 0x43da9d
mov ecx, ebp
call fcn.00439702
lea eax, [esp + 0x1c]
cmp edi, eax
je 0x43daac
mov ecx, edi
call fcn.00439702
pop edi
mov eax, esi
pop ebp
jmp 0x43dab7
mov eax, 0xfffff019
mov ecx, dword [esp + 0x414]
pop esi
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x410
ret