joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b3e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.0041aed0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41b405
mov eax, 0xfffffff5
jmp 0x41b539
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x41b41d
mov eax, 0xfffffff4
jmp 0x41b539
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x41b44b
mov edx, dword [ebp - 4]
push edx
call fcn.0041b6b0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41b44b
mov eax, dword [ebp - 8]
jmp 0x41b539
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x41b4ba
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041b160
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x41b4ba
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x41b4ba
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x41b4f6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x41b522
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41b680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x41e480
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNC_BUFFER_TOO_SMALL_OPTION
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41e4c2
push str.crash
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x41e4c2
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov esp, ebp
pop ebp
ret

Function at 0x420850
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x45e884
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x420875
call fcn.00420fd0
jmp 0x420974
push 0x45e888
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x42088f
call fcn.00421500
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4208ad
mov eax, dword [ebp - 4]
jmp 0x420974
cmp dword [0x493f30], 0
jne 0x4208bb
call fcn.00420980
push 0x45e890
mov eax, dword [0x493f30]
push eax
call fcn.0041ec30
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x4208e1
xor eax, eax
jmp 0x420974
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x493f30]
push ecx
call fcn.0041f2f0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x420971
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x420913
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x42091f
jmp 0x42090a
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x420933
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jb 0x420952
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x420952
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
jl 0x420952
jmp 0x42092a
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x420971
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x421520
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x45e894
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x421562
push str.WNCTMPDIR
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x421560
push str.from_environment_variable_WNCTMPDIR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x4215a0
jmp 0x421589
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x421589
push str.from_environment
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 8
xor eax, eax
jmp 0x4215a0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x493f30]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041eba0
add esp, 0xc
pop ebp
ret

Function at 0x421620
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x421640
xor eax, eax
jmp 0x421778
mov eax, dword [ebp + 8]
push eax
push 0x45e8e0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42167a
mov eax, dword [ebp - 4]
jmp 0x421778
cmp dword [0x493f30], 0
jne 0x421688
call fcn.00420980
push str.path
mov eax, dword [0x493f30]
push eax
call fcn.0041ec30
add esp, 8
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
test ecx, ecx
jge 0x4216ae
xor eax, eax
jmp 0x421778
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 8]
push eax
mov ecx, dword [0x493f30]
push ecx
call fcn.0041f2f0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421775
mov edx, dword [ebp - 4]
mov dword [ebp - 0x214], edx
jmp 0x4216ed
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
movsx edx, byte [ecx]
test edx, edx
je 0x4216fc
jmp 0x4216de
mov eax, dword [ebp - 0x214]
sub eax, 1
mov dword [ebp - 0x214], eax
jmp 0x42171c
mov ecx, dword [ebp - 0x214]
sub ecx, 1
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 4]
jb 0x421744
mov eax, dword [ebp - 0x214]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x421744
mov edx, dword [ebp - 0x214]
movsx eax, byte [edx]
test eax, eax
jl 0x421744
jmp 0x42170d
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
movsx eax, byte [edx]
test eax, eax
je 0x421775
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp - 0x218]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043b9f2
mov esp, ebp
pop ebp
ret
Function at 0x421790
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push str._sPATH
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
je 0x4217e1
lea eax, [ebp - 0x58]
push eax
push str.from_environment__s
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
xor eax, eax
jmp 0x4217f7
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x493f30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041eba0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b9f2
mov esp, ebp
pop ebp
ret

Function at 0x426720
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x1ff
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041e9a0
push 0x2c
lea edx, [ebp - 0x208]
push edx
call fcn.0041cfb0
add esp, 8
test eax, eax
je 0x4267c1
mov eax, dword [ebp + 0x10]
push eax
push 0x1ff
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041cc70
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x4267c1
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffd5
jne 0x4267bf
push 0x2c
lea eax, [ebp - 0x208]
push eax
call fcn.0041cfb0
add esp, 8
test eax, eax
jne 0x4267bf
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x4267c1
jmp 0x426822
lea edx, [ebp - 9]
mov dword [ebp - 4], edx
jmp 0x4267d2
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x208]
cmp ecx, edx
jb 0x4267f6
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x4267f6
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jl 0x4267f6
jmp 0x4267c9
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x426822
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffeb
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043b9f2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x427210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42722b
xor eax, eax
jmp 0x427237
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x427320
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
test eax, eax
je 0x427344
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0xd
je 0x427344
or eax, 0xffffffff
jmp 0x427346
xor eax, eax
pop ebp
ret
Function at 0x4275d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x45f0d4
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x427602
mov eax, dword [ebp - 4]
jmp 0x427789
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42774d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x427641
xor eax, eax
jmp 0x427789
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x42765e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x427684
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x427682
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x42764f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.004277a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4276a5
xor eax, eax
jmp 0x427789
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.004277a0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4276d5
xor eax, eax
jmp 0x427789
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.004277a0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x427705
xor eax, eax
jmp 0x427789
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x45f0e8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x427740
push 0x45f0ec
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x427744
xor eax, eax
jmp 0x427789
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x427786
push str.WNCHOME
push 0x495fa8
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x495fa8
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x495fa8
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0043b9f2
mov esp, ebp
pop ebp
ret

Function at 0x427900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x427939
push 0x45f114
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x427939
mov eax, 1
jmp 0x42793b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x436ea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45493b
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x46aff0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
push 1
mov ecx, dword [ebp + 8]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea ecx, [ebp - 0x18]
call fcn.00437630
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004376a0
movzx edx, al
test edx, edx
jne 0x436f1b
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00437660
mov eax, dword [ebp - 0x2c]
jmp 0x437010
mov byte [ebp - 0xd], 0
cmp dword [ebp + 0x10], 0
jbe 0x436f45
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.00437680
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x436f45
mov byte [ebp - 0xd], 1
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x436fc3
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x18]
call fcn.00437680
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x436f89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00437660
mov eax, dword [ebp - 0x30]
jmp 0x437010
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.00437680
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x102
jne 0x436fc3
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00437660
mov eax, dword [ebp - 0x34]
jmp 0x437010
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00436d80
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x436ff7
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00437660
mov eax, dword [ebp - 0x38]
jmp 0x437010
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00437660
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x437530
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4549ef
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.00438bb0
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0xffffffff
jne 0x437585
or eax, 0xffffffff
jmp 0x43760c
mov dword [ebp - 0x454], 0x428
lea ecx, [ebp - 0x454]
push ecx
mov edx, dword [ebp - 0x458]
push edx
call sub.KERNEL32.dll_Module32FirstW
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x4375fd
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004378a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00438ab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00436aa0
lea edx, [ebp - 0x454]
push edx
mov eax, dword [ebp - 0x458]
push eax
call sub.KERNEL32.dll_Module32NextW
mov dword [ebp - 0x45c], eax
jmp 0x4375a8
mov ecx, dword [ebp - 0x458]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b9f2
mov esp, ebp
pop ebp
ret

Function at 0x43b9f2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46aff0]
jne 0x43b9fc
repz ret
jmp fcn.0043beb4

Function at 0x43d850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x49c204], 0
je 0x43d8b6
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___d__:__d_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
mov ecx, dword [0x49c200]
push ecx
lea edx, [ebp - 0x408]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b9f2
mov esp, ebp
pop ebp
ret

Function at 0x43ddd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x461188
cmp dword [0x497d3c], 0
je 0x43ddef
mov eax, 0x497d40
jmp 0x43de10
push 0x46118c
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43de0d
mov eax, dword [ebp - 8]
jmp 0x43de10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43de80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x497d3c], 0
je 0x43dea1
push 0x497d40
push 0x49bfc8
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x43dedd
push 0x4611a0
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43decc
push 0x4611a8
push 0x49bfc8
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x43dedd
mov eax, dword [ebp - 4]
push eax
push 0x49bfc8
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x4611ac
mov ecx, dword [ebp + 8]
push ecx
call fcn.00453250
add esp, 8
push eax
push 0x5c
push 0x49bfc8
push str._s_c_s
push 0x49bdc0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
push 0x201
push 0x49bdc0
call fcn.0041e8d0
add esp, 8
cmp dword [0x49c1d4], 0
jne 0x43df3b
push 0x43dd70
call fcn.0043baaf
add esp, 4
mov dword [0x49c1d4], 1
mov esp, ebp
pop ebp
ret

Function at 0x4446a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0043de70
test eax, eax
je 0x4446d3
call fcn.0043ddd0
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x44471c
push str.WNCZONE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x444706
push 0x461ae0
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x44471c
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
push str..inf
push 0x461aec
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x461af4
push 0x49c208
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x49c408], 0
push 0x461b00
push 0x49c208
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x49c208], 0
push 0x201
push 0x49c208
call fcn.00444530
add esp, 8
push str..lck
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x49c410
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x49c610], 0
push 0x461b20
push 0x49c410
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x49c410], 0
push 0x201
push 0x49c410
call fcn.00444530
add esp, 8
cmp dword [0x49c61c], 0
jne 0x4447ee
push 0x444650
call fcn.0043baaf
add esp, 4
mov dword [0x49c61c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b9f2
mov esp, ebp
pop ebp
ret
Function at 0x44c0b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x49c760]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
cmp esi, eax
je 0x44c10a
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffe6
jmp 0x44c140
mov dx, word [0x461c70]
mov word [ebp - 8], dx
mov al, byte [0x461c72]
mov byte [ebp - 6], al
mov ecx, dword [ebp - 4]
push ecx
push 2
push 1
lea edx, [ebp - 8]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 2
je 0x44c140
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffe6
pop esi
mov esp, ebp
pop ebp
ret