joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426e90
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x4e
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x426eb7
jmp 0x426f04
cmp dword [ebp - 4], 0x95
jbe 0x426ed4
mov ecx, dword [ebp - 4]
push ecx
push str.7a0f3dfdc14997890c3
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426f04
push str.4f5bf35f557141cd
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x426efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45453c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426f04
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x428d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ce54
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xa0
push ebx
push esi
push edi
mov eax, dword [0x4612c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x98], ecx
mov eax, dword [sym.imp.MSVCR90.dll___argc]
cmp dword [eax], 3
je 0x428d66
xor eax, eax
jmp 0x428edf
push 2
lea ecx, [ebp - 0x94]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x78], esp
push 2
push 0x4548c0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___unsigned_int_]
mov dword [ebp - 0x9c], eax
lea ecx, [ebp - 0x74]
call fcn.00402390
mov dword [ebp - 0xa0], eax
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xa4]
call fcn.00402690
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xac]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, dword [sym.imp.MSVCR90.dll___argv]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.MSVCR90.dll__strnicmp]
add esp, 0xc
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x19], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.004355a0
movzx ecx, byte [ebp - 0x19]
test ecx, ecx
je 0x428e51
xor eax, eax
jmp 0x428edf
push 0
push 0
mov edx, dword [sym.imp.MSVCR90.dll___argv]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_strtoul]
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x428e77
xor eax, eax
jmp 0x428edf
mov edx, dword [ebp - 0x14]
imul edx, edx, 3
mov eax, dword [ebp - 0x14]
lea ecx, [edx + eax*2 + 0x15]
mov dword [ebp - 0x18], ecx
call fcn.00406a20
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
je 0x428e9d
jmp 0x428ea7
call fcn.00402070
call fcn.0041ded0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.MSVCR90.dll_exit]
mov dword [ebp - 4], 4
call fcn.00406a20
jmp 0x428ed6
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429230
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x180
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x17c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x17c], 0
jne 0x429279
mov eax, dword [ebp - 4]
mov dword [eax + 0x308], 1
xor eax, eax
jmp 0x4292b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4292b5
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x308], 0
call fcn.0043da00
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
je 0x4292a3
jmp 0x4292ad
call fcn.00426580
call fcn.00420bf0
push 0
call dword [sym.imp.MSVCR90.dll_exit]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4292f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44cea0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1a4
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1b0], ecx
call fcn.0041bf50
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
je 0x42933e
jmp 0x429348
call fcn.004269e0
call fcn.004269e0
mov eax, 0x202
mov word [ebp - 0x1ac], ax
lea ecx, [ebp - 0x1a8]
push ecx
movzx edx, word [ebp - 0x1ac]
push edx
call sub.WS2_32.dll_WSAStartup
xor eax, eax
jmp 0x429398
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x429660
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c069
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4612c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x14], eax
call fcn.0041bea0
test eax, eax
je 0x4296b5
call fcn.0041e480
call fcn.0041e4f0
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4296d7
mov dword [ebp - 0x18], 0x80004005
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x18]
jmp 0x429715
mov eax, dword [ebp - 0x14]
and eax, 0x10
je 0x4296fb
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x1c]
jmp 0x429715
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x429730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00449690
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x100c], ecx
mov dword [ebp - 4], 0
mov al, byte [0x452257]
mov byte [ebp - 0x1008], al
push 0xfff
push 0
lea ecx, [ebp - 0x1007]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1008]
push edx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x429797
mov eax, 0x80004005
jmp 0x429810
cmp dword [ebp - 4], 0x1000
jb 0x4297a7
mov eax, 0x80004005
jmp 0x429810
lea eax, [ebp - 0x1008]
push eax
mov ecx, dword [ebp - 0x100c]
add ecx, 0x19c
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
call fcn.0041bf50
test eax, eax
je 0x4297d3
call fcn.00402070
call fcn.0041e620
push 0x43
push 0xdd
call fcn.0041c500
add esp, 8
cmp eax, 0x39d7
jne 0x4297eb
jmp 0x4297f9
call fcn.00420fa0
call fcn.004078a0
jmp 0x4297f9
xor eax, eax
jmp 0x429810
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x42ac20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d219
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.00449690
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1028], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1018], 0
mov al, byte [0x45225b]
mov byte [ebp - 0x1014], al
push 0xfff
push 0
lea ecx, [ebp - 0x1013]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x1000
lea edx, [ebp - 0x1014]
push edx
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x1018], 0
jne 0x42acd4
mov dword [ebp - 0x101c], 0x80004005
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x101c]
jmp 0x42ad32
cmp dword [ebp - 0x1018], 0x1000
jb 0x42ad02
mov dword [ebp - 0x1020], 0x80004005
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x1020]
jmp 0x42ad32
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 0x24]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov dword [ebp - 0x1024], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x1024]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret 0x20
Function at 0x42df40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x88], 0
jne 0x42df5f
mov eax, 0x80004005
jmp 0x42dff1
cmp dword [ebp + 0xc], 0
jne 0x42df6f
mov eax, 0x80004005
jmp 0x42dff1
mov ecx, dword [ebp + 8]
add ecx, 0x58
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x58
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x20
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42dfe2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x84]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x84], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x84], 3
jle 0x42dfdb
mov eax, dword [ebp + 8]
mov dword [eax + 0x88], 0
mov eax, 0x80004005
jmp 0x42dff1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x84], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x43dcc0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.34ab0fa108af4a192105e8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x43dcf1
jmp 0x43ddf5
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x9e
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x98
xor edx, edx
div dword [ebp - 0x20]
add edx, 0xa7
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x15a
mov edx, 0x6f
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x43dd49
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x43dd69
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x43dd40
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x43dd99
jmp 0x43ddf5
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x43ddbd
jmp 0x43ddf5
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x43e0c0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xb5
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e0ea
jmp 0x43e134
cmp dword [ebp - 4], 0x69
jbe 0x43e104
mov ecx, dword [ebp - 4]
push ecx
push str.26396539b3394a1f9d230dd3ebeff8f
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e134
push str.231ddc6b256308b34d71b70747335
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x43e12a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4554c0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e134
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x43e150
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xa3
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e17a
jmp 0x43e1c4
cmp dword [ebp - 4], 0x64
jbe 0x43e194
mov ecx, dword [ebp - 4]
push ecx
push str.dfa9240f25d59381d1e75
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e1c4
push str.6729431f74f53a2756d9c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x43e1ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x455510
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e1c4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x43e270
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.2b93919fef9b6bade2
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x43e2a1
jmp 0x43e3a2
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x51
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x1c
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x49
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x81
mov edx, 1
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x43e2f6
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x43e316
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x43e2ed
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x43e346
jmp 0x43e3a2
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x43e36a
jmp 0x43e3a2
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x43e3b0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x12
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e3d7
jmp 0x43e424
cmp dword [ebp - 4], 0x8f
jbe 0x43e3f4
mov ecx, dword [ebp - 4]
push ecx
push str.d54f9e19a661c6f114f3883d514
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e424
push str.95c3addf521347bb4
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x43e41a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x455810
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e424
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x43e540
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xa8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e56a
jmp 0x43e5b4
cmp dword [ebp - 4], 0x52
jbe 0x43e584
mov ecx, dword [ebp - 4]
push ecx
push str.adb733c74d3fccc5fdcba1d3
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e5b4
push str.8643efcff809a0233755cda357ef
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x43e5aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4558c4
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e5b4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x43e7d0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x85
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e7fa
jmp 0x43e844
cmp dword [ebp - 4], 0x3f
jbe 0x43e814
mov ecx, dword [ebp - 4]
push ecx
push str.6a0dd633f32ff8ddcf531d4fa79
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e844
push str.91f5ba6984af145feda14d3b5f333e6
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x43e83a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45597c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x43e844
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x43e860
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.679f27c1c71bad2b048960292cf
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x43e891
jmp 0x43e992
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x71
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0xcd
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x36
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0xe5
mov edx, 0xa9
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x43e8e6
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x43e906
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x43e8dd
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x43e936
jmp 0x43e992
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x43e95a
jmp 0x43e992
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret