joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4080e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d93b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x461840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00433f62
push 4
mov dword [ebp - 4], 0
call fcn.0043604d
mov edi, eax
add esp, 4
test edi, edi
je 0x408160
call fcn.00433e2f
mov dword [edi], eax
call fcn.00433bee
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00433f23
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x408156
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00433f4b
jmp 0x408162
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44f040
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x461840]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
movzx eax, word [esi + 0xc]
push ecx
mov edx, 1
mov ecx, esp
mov word [ecx], dx
lea edx, [eax + 1]
cmp edx, 2
jge 0x418ced
lea ecx, [esp + 0x18]
call fcn.004034f0
push eax
mov dword [esp + 0x78], 0
call fcn.00405490
cmp eax, 0x1f
jbe 0x418d09
lea ecx, [esp + 0x2c]
call fcn.004034f0
push eax
mov dword [esp + 0x78], 1
call fcn.00405490
mov word [ecx], ax
mov ax, word [esi + 0x10]
inc ax
push ecx
movzx eax, ax
mov edx, 1
mov ecx, esp
mov word [ecx], dx
lea edx, [eax + 1]
cmp edx, 2
jge 0x418d3f
lea ecx, [esp + 0x3c]
call fcn.00403650
push eax
mov dword [esp + 0x7c], 2
call fcn.00405770
cmp eax, 0xc
jbe 0x418d5b
lea ecx, [esp + 0x48]
call fcn.00403650
push eax
mov dword [esp + 0x7c], 3
call fcn.00405770
mov word [ecx], ax
mov eax, 0x76c
add ax, word [esi + 0x14]
push ecx
movzx eax, ax
mov edx, 0x578
mov ecx, esp
mov word [ecx], dx
lea edx, [eax + 1]
cmp edx, 0x579
jge 0x418d9a
lea ecx, [esp + 0x58]
call fcn.004035a0
push eax
mov dword [esp + 0x80], 4
call fcn.00405710
mov edx, 0x2710
cmp ax, dx
jbe 0x418dbe
lea ecx, [esp + 0x64]
call fcn.004035a0
push eax
mov dword [esp + 0x80], 5
call fcn.00405710
mov word [ecx], ax
lea ecx, [esp + 0x1c]
call fcn.00403710
mov eax, dword [esi + 8]
mov edi, dword [esi]
mov ebx, dword [esi + 4]
test eax, eax
js 0x418e2e
test ebx, ebx
js 0x418e2e
test edi, edi
js 0x418e2e
cdq
mov ecx, eax
mov esi, edx
shld esi, ecx, 4
shl ecx, 4
sub ecx, eax
sbb esi, edx
shld esi, ecx, 2
add ecx, ecx
add ecx, ecx
mov eax, ebx
cdq
add ecx, eax
adc esi, edx
mov edx, ecx
mov eax, esi
shld eax, edx, 4
shl edx, 4
sub edx, ecx
sbb eax, esi
shld eax, edx, 2
add edx, edx
mov esi, eax
lea ecx, [edx + edx]
mov eax, edi
cdq
push 0
add ecx, eax
push 0xf4240
adc esi, edx
push esi
push ecx
call fcn.0043a380
jmp 0x418eab
cdq
xor eax, edx
sub eax, edx
cdq
mov ecx, eax
mov esi, edx
shld esi, ecx, 4
shl ecx, 4
sub ecx, eax
sbb esi, edx
shld esi, ecx, 2
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cdq
add ecx, ecx
add ecx, ecx
add ecx, eax
adc esi, edx
mov edx, ecx
mov eax, esi
shld eax, edx, 4
shl edx, 4
sub edx, ecx
sbb eax, esi
shld eax, edx, 2
mov esi, eax
add edx, edx
lea ecx, [edx + edx]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cdq
push 0
add ecx, eax
push 0xf4240
adc esi, edx
push esi
push ecx
call fcn.0043a380
mov ecx, eax
xor eax, eax
mov esi, edx
cdq
xor eax, edx
xor edi, edi
xor edi, edx
sub edi, edx
sbb eax, edx
mov edx, eax
mov eax, edi
neg eax
adc edx, 0
neg edx
sub eax, ecx
sbb edx, esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x18], edx
call fcn.004195a0
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f0d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x42e5e1
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x44c0fd
call fcn.00438dfc
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x42e6d5
cmp byte [esi + 0x49], bl
je 0x42e6d5
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x42e616
xor al, al
jmp 0x42e6d7
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040d6a0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x42e678
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x42e67d
dec eax
je 0x42e681
dec eax
dec eax
je 0x42e6d1
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401770
mov al, bl
jmp 0x42e6d7
mov edx, dword [ebp - 0x2c]
jmp 0x42e63f
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x42e68d
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x42e6b3
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x42e6a0
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.00439931
add esp, 0x10
cmp edi, eax
jne 0x42e662
cmp byte [esi + 0x49], 0
je 0x42e6d1
test edi, edi
jne 0x42e631
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00404a60
jmp 0x42e631
mov bl, 1
jmp 0x42e664
mov al, 1
call fcn.00438e7f
ret

Function at 0x42ee83
Capabilities:
Copy file

Disassembly:
push 0x40
mov eax, 0x44c341
call fcn.00438dfc
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0042fabf
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0042fabf
add esp, 0x10
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0x10
mov ecx, dword [ebp - 0x2c]
jae 0x42eec0
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x42eecc
lea eax, [ebp - 0x48]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
sete byte [ebp - 0x49]
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401770
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00401770
mov al, byte [ebp - 0x49]
call fcn.00438e7f
ret
Function at 0x42f009
Capabilities:
Set file attributes

Disassembly:
push 0x20
mov eax, 0x44c30c
call fcn.00438dfc
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0042fabf
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x42f034
lea eax, [ebp - 0x2c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x42f05e
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401770
mov al, bl
call fcn.00438e7f
ret
mov bl, 1
jmp 0x42f046

Function at 0x42f1b3
Capabilities:
Check os version

Disassembly:
push 0x16c
mov eax, 0x44c3c9
call fcn.00438dfc
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x48]
xor ebx, ebx
push eax
mov byte [ebp - 0x15d], bl
call fcn.0042fabf
pop ecx
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x42f1ee
lea eax, [ebp - 0x48]
push ebx
push 0x80
push 3
push ebx
push 1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x164], eax
cmp eax, 0xffffffff
je 0x42f342
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x16c], esp
push str.Kernel32.dll
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], ebx
call fcn.00401380
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], bl
call fcn.0043289c
add esp, 0x20
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x42f254
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x168], eax
cmp eax, ebx
je 0x42f30c
lea eax, [ebp - 0x15c]
push eax
mov dword [ebp - 0x15c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x158], 5
jae 0x42f2d5
push str.GetFileSize
push dword [ebp - 0x168]
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x178], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x42f2bb
lea ecx, [ebp - 0x178]
push ecx
push dword [ebp - 0x164]
call eax
jmp 0x42f2c1
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x170], eax
jmp 0x42f2f9
push str.GetFileSizeEx
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x42f2f9
lea ecx, [ebp - 0x174]
push ecx
push dword [ebp - 0x164]
call eax
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 0x15d], 1
push 8
lea eax, [ebp - 0x174]
push eax
push esi
call fcn.00436f30
mov eax, dword [esi]
add esp, 0xc
push dword [ebp - 0x164]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401770
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00401770
mov al, byte [ebp - 0x15d]
call fcn.00438e7f
ret
Function at 0x42f93e
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x3c
mov eax, 0x44c54f
call fcn.00438dfc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0042fabf
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x42f89e
lea eax, [ebp - 0x2c]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
mov bl, 1
test eax, eax
je 0x42f8c5
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401770
mov al, bl
call fcn.00438e7f
ret
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.0042f4b9
pop ecx
pop ecx
mov byte [ebp - 4], 1
xor esi, esi
cmp dword [ebp - 0x38], esi
je 0x42f8ec
lea eax, [ebp - 0x48]
push eax
call 0x42f873
mov bl, al
pop ecx
test bl, bl
je 0x42f92a
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x42f8f8
lea eax, [ebp - 0x2c]
push eax
call edi
test eax, eax
jne 0x42f92a
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x42f90b
lea eax, [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x42f92a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
mov byte [ebp - 4], 0
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.00401770
jmp 0x42f8ad
push ebp
mov ebp, esp
pop ebp
jmp 0x42f873

Function at 0x43268b
Capabilities:
Get common file path

Disassembly:
push 0x450
mov eax, 0x44d133
call fcn.00438dfc
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
mov byte [ebp - 0x459], bl
call fcn.004372a0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4327d4
push esi
lea eax, [ebp - 0x420]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00401420
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.0042fa03
pop ecx
pop ecx
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.004018c0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4327aa
cmp byte [ebp + 0xc], bl
je 0x4327aa
mov dword [ebp - 0x428], 0xf
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
mov byte [ebp - 4], 3
lea eax, [ebp - 0x420]
push eax
call fcn.00438e9d
inc eax
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00401ba0
lea eax, [ebp - 0x43c]
push eax
call fcn.004330b2
pop ecx
test al, al
je 0x432796
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x458]
push eax
mov ecx, edi
call fcn.004015f0
mov byte [ebp - 0x459], 1
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.00401770
jmp 0x4327c2
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x458]
push eax
mov ecx, edi
call fcn.004015f0
mov byte [ebp - 0x459], 1
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x458]
call fcn.00401770
mov al, byte [ebp - 0x459]
call fcn.00438e7f
ret
Function at 0x4330b2
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x461840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004372a0
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4330e9
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0043a04c
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43311d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43311f
mov bl, 1
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00435af5
leave
ret

Function at 0x43312f
Capabilities:
Check if file exists

Disassembly:
push 0x24c
mov eax, 0x44d3a7
call fcn.00438dfc
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
mov byte [ebp - 0x251], bl
call fcn.004372a0
mov dword [ebp - 0x220], 0xf
mov dword [ebp - 0x224], ebx
mov byte [ebp - 0x234], bl
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.0043301c
add esp, 0x1c
cmp eax, 1
jne 0x4331e7
lea eax, [ebp - 0x218]
push eax
call fcn.00438e9d
inc eax
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00401ba0
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.0042f947
pop ecx
pop ecx
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00401570
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x250]
call fcn.00401770
jmp 0x43327d
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
call fcn.0043306b
pop ecx
pop ecx
test al, al
je 0x4332bc
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4332bc
lea eax, [ebp - 0x218]
push eax
call fcn.00438e9d
inc eax
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00401ba0
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.0042f947
pop ecx
pop ecx
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00401570
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x250]
call fcn.00401770
lea eax, [ebp - 0x258]
push eax
call fcn.00433089
pop ecx
mov byte [ebp - 0x251], 1
cmp byte [ebp + 0x10], bl
je 0x4332bc
cmp dword [ebp - 0x220], 0x10
mov eax, dword [ebp - 0x234]
jae 0x43329e
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4332bc
lea eax, [ebp - 0x234]
push eax
call fcn.004330b2
pop ecx
mov byte [ebp - 0x251], al
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x234]
call fcn.00401770
mov al, byte [ebp - 0x251]
call fcn.00438e7f
ret

Function at 0x435af5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x461840]
jne 0x435aff
repz ret
jmp fcn.0043de6a
Function at 0x44665c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x461840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0043d74c
and dword [ebp - 0x14], 0
cmp dword [0x464de0], 0
mov dword [ebp - 0x18], eax
jne 0x44670f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4467b7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4467b7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x464de0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x464de4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x464de8], eax
call edi
push eax
call esi
mov dword [0x464df0], eax
test eax, eax
je 0x44670f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x464dec], eax
mov eax, dword [0x464dec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x446768
cmp dword [0x464df0], ecx
je 0x446768
push eax
call esi
push dword [0x464df0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x446768
test ebx, ebx
je 0x446768
call edi
test eax, eax
je 0x44675f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x44675f
test byte [ebp - 8], 1
jne 0x446768
or dword [ebp + 0x10], 0x200000
jmp 0x44679b
mov eax, dword [0x464de4]
cmp eax, dword [ebp - 0x18]
je 0x44679b
push eax
call esi
test eax, eax
je 0x44679b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44679b
mov eax, dword [0x464de8]
cmp eax, dword [ebp - 0x18]
je 0x44679b
push eax
call esi
test eax, eax
je 0x44679b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x464de0]
call esi
test eax, eax
je 0x4467b7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4467b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435af5
leave
ret
Function at 0x401b80
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401bcb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401bc4
test esi, esi
je 0x401bc4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ba0
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401db0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401ed4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401e3e
cmp eax, 4
jne 0x401e60
test esi, esi
je 0x401e52
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401e44
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401e9f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401e91
cmp ecx, 0x40
je 0x401e52
cmp ecx, 4
je 0x401e52
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401db0
lea esi, [esi]
Function at 0x4028c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x11
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x4028d8
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x4028e6
xor eax, eax
jmp 0x4028ff
call fcn.004027c0
test eax, eax
je 0x4028e2
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.004027e0
mov eax, dword [ebp - 8]
mov ecx, eax
shr ecx, 1
and ecx, eax
test ecx, 0x8000000
je 0x4028d2
xor ecx, ecx
xgetbv
mov eax, ecx
shr eax, 2
shr ecx, 1
and eax, ecx
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402a30
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402a6f
push str.SetDefaultDllDirectories
push 0x9946b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402a6f
push 0xc00
call eax
test eax, eax
jne 0x402b07
push 0x106
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402b07
cmp eax, 0x104
ja 0x402b07
cmp word [ebp + eax*2 - 0x2d2], 0x5c
je 0x402aa9
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d0], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x402b06
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ebx, [ebp + eax*2 - 0x2d0]
mov cl, byte [esi]
inc esi
mov eax, ebx
test cl, cl
je 0x402ae0
movzx edx, cl
mov cl, byte [esi]
mov word [eax], dx
add eax, 2
inc esi
test cl, cl
jne 0x402ad0
xor ecx, ecx
push 8
push ecx
lea edx, [ebp - 0x2d0]
push edx
mov dword [eax], 0x64002e
mov dword [eax + 4], 0x6c006c
mov word [eax + 8], cx
call edi
cmp byte [esi], 0
jne 0x402ac7
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret