joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4193a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0xb5
idiv ecx
inc esi
add dl, 0x49
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4193d6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419457
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419457
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x419550
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.6a01d0eb587d7937ab9
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x419634
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xd3
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x82
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0xb3
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x4195e7
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x4195c5
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x155
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x419631
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x419631
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
Function at 0x419640
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0xe7
idiv ecx
inc esi
sub dl, 0x75
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419676
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4196f7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4196f7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x419710
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.fe856d4fb85371ffd23371cf9ab9a
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4197f4
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0x67
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0xf6
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0xff
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x4197a7
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x419785
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x144
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x4197f1
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x4197f1
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
Function at 0x419800
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.0043c523
push str.ca3dfe93fbe5c35d0
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.0043c75a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.add717c91b557e69f66b6b95b1e7
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x419878
add edi, 0x1000
push edi
push esi
call fcn.0043c8db
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.e5a9cbc56e53b4dd5011c5d75
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419845
test eax, eax
jne 0x41988f
push edi
push str.004b5f29a821d1ef2641947_d
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.7571e58b74891b07d90307114fb75cb__d_
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4198b0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x94
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419933
cmp eax, 0x9f
jbe 0x4198f5
push eax
push str.c0c9c29fb1f7aebddbdfd
call fcn.0043c75a
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.d44998a7ef47e59be3e555
call esi
test eax, eax
jne 0x41992b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.0043c75a
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
Function at 0x419950
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.a6b17b61da078a556d875
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4199f7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4199f7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419a10
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4199f7
test al, 1
jne 0x4199d5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4199a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4199f7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.7f0f50a7081b9b697959495
call fcn.0043c75a
add esp, 4
jmp 0x4199f7

Function at 0x419b00
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.3e47d51f65f3ab3f8c598cedfaf1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x419be4
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xd7
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x30
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0xa6
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x419b97
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x419b75
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0xba
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x419be1
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x419be1
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
Function at 0x419bf0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.4d693b1d439905bfbb69
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419c97
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419c97
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419cb0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419c97
test al, 1
jne 0x419c75
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419c42
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419c97
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.f12b24c920bd54d3fba18
call fcn.0043c75a
add esp, 4
jmp 0x419c97

Function at 0x419d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0xc9
idiv ecx
inc esi
add dl, 0x24
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419db6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419e37
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419e37
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret
Function at 0x419e50
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419ece
cmp eax, 0x19
jbe 0x419e90
push eax
push str.85435da3c857d31bdf138fb7740908
call fcn.0043c75a
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.cd950807e35546ddfbd9
call esi
test eax, eax
jne 0x419ec6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.0043c75a
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret

Function at 0x419fa0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.936feb25083128e7
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41a07e
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xf4
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x76
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0x4f
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x41a034
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x41a012
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x7c
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x41a07b
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x41a07b
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
Function at 0x41c300
Capabilities:
Check mutex on windows

Disassembly:
push ecx
cmp dword [esi + 0x198], 0x10
jb 0x41c312
mov eax, dword [esi + 0x184]
jmp 0x41c318
lea eax, [esi + 0x184]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x17c], eax
call fcn.004179f0
test eax, eax
je 0x41c337
call fcn.00417f00
cmp dword [esi + 0x17c], 0
jne 0x41c34e
mov dword [esi + 0x308], 1
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41c34a
push 0
mov dword [esi + 0x308], 0
call fcn.0043d1f9
int3

Function at 0x41c3e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x19c], eax
lea eax, [esp + 3]
mov byte [esp + 3], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c400
sub eax, edx
je 0x41c410
call fcn.00419f50
lea eax, [esp + 8]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [esp + 0x19c]
xor ecx, esp
xor eax, eax
call fcn.0043c2d9
add esp, 0x1a4
ret

Function at 0x41c740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp], eax
mov eax, dword [esp + 0xc]
push ebx
mov ebx, pe_nt_image_headers32
cmp dword [esp + 0x24], ebx
jae 0x41c75f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41c792
cmp dword [esp + 0x24], ebx
jb 0x41c77e
mov eax, dword [esp + 0x10]
push eax
call fcn.0043c853
add esp, 4
mov eax, 0x80004005
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0043c2d9
pop ecx
ret 0x1c
test bl, al
je 0x41c7a3
cmp dword [esp + 0x24], ebx
jb 0x41c7b6
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x41c7ae
cmp dword [esp + 0x24], ebx
jb 0x41c7b6
mov edx, dword [esp + 0x10]
push edx
call fcn.0043c853
add esp, 4
mov ecx, dword [esp + 4]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043c2d9
pop ecx
ret 0x1c

Function at 0x41c7d0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1018
call fcn.0044d3e0
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x1010], eax
push esi
push 0xfff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.00444d20
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, eax
lea eax, [esp + 0xb]
mov byte [esp + 0xb], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c820
sub eax, edx
je 0x41c835
call fcn.00439810
call fcn.00418060
test esi, esi
jne 0x41c854
mov eax, 0x80004005
pop esi
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x1018
ret
cmp esi, 0x1000
jae 0x41c839
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c863
sub eax, edx
push eax
lea edx, [esp + 0x14]
push edx
lea ecx, [edi + 0x19c]
call fcn.004033f0
mov ecx, dword [esp + 0x1014]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0043c2d9
add esp, 0x1018
ret
Function at 0x41df20
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4539d8
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.0044d3e0
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x1000], eax
push edi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0x100c]
mov dword fs:[0], eax
push 0xfff
lea eax, [esp + 0xd]
push 0
mov dword [esp + 0x101c], 0
push eax
mov byte [esp + 0x14], 0
call fcn.00444d20
mov eax, dword [esp + 0x102c]
mov edi, pe_nt_image_headers32
add esp, 0xc
cmp dword [esp + 0x1034], edi
jae 0x41df9c
lea eax, [esp + 0x1020]
push 0x1000
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x41dfd1
cmp dword [esp + 0x1034], edi
jb 0x41dfca
mov edx, dword [esp + 0x1020]
push edx
call fcn.0043c853
add esp, 4
mov eax, 0x80004005
jmp 0x41e031
cmp eax, 0x1000
jb 0x41dff8
cmp dword [esp + 0x1034], edi
jb 0x41dfca
mov eax, dword [esp + 0x1020]
push eax
call fcn.0043c853
add esp, 4
mov eax, 0x80004005
jmp 0x41e031
lea eax, [esp + 8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e000
sub eax, edx
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004033f0
cmp dword [esp + 0x1034], edi
jb 0x41e02f
mov edx, dword [esp + 0x1020]
push edx
call fcn.0043c853
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x100c]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x1010
ret 0x1c
Function at 0x421310
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x454b80
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov eax, dword [ebp + 0x74]
lea ebx, [esi + 0x2c0]
mov ecx, ebx
call fcn.004298c0
cmp dword [eax + 0x3c], 0
je 0x421512
mov edi, pe_nt_image_headers32
cmp dword [ebp + 0x70], edi
jb 0x421371
mov ecx, dword [ebp + 0x5c]
jmp 0x421374
lea ecx, [ebp + 0x5c]
cmp dword [esi + 0x25c], edi
jb 0x421384
mov eax, dword [esi + 0x248]
jmp 0x42138a
lea eax, [esi + 0x248]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov eax, dword [ebp + 0x74]
mov ecx, ebx
jne 0x421519
call fcn.004298c0
inc dword [eax + 0x38]
add eax, 0x38
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.004298c0
cmp dword [eax + 0x38], 3
jle 0x421512
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.004298c0
cmp dword [eax + 0x18], edi
jb 0x4213d4
mov eax, dword [eax + 4]
jmp 0x4213d7
add eax, 4
push eax
lea eax, [esp + 0x20]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, 0x10
jb 0x421406
mov ecx, dword [edi]
jmp 0x421408
mov ecx, edi
cmp ecx, 0x45c64c
ja 0x421443
cmp eax, 0x10
jb 0x421419
mov ecx, dword [edi]
jmp 0x42141b
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45c64c
jbe 0x421443
cmp eax, 0x10
jb 0x42142f
mov edi, dword [edi]
push 0x3b
mov eax, 0x45c64c
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x421487
cmp eax, 0x3b
jae 0x421455
mov ecx, dword [esi + 0x14]
push ecx
push 0x3b
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x421461
mov eax, dword [edi]
jmp 0x421463
mov eax, edi
push 0x3b
push 0x45c64c
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x3b
jb 0x421483
mov edi, dword [edi]
mov byte [edi + 0x3b], 0
lea esi, [esp + 0x5c]
call fcn.00401900
xor edi, edi
mov ecx, eax
mov dword [esp + 0xa0], edi
call fcn.00401b50
mov esi, pe_nt_image_headers32
mov byte [esp + 0x9c], 1
cmp dword [eax + 0x18], esi
jb 0x4214b7
mov eax, dword [eax + 4]
jmp 0x4214ba
add eax, 4
mov edx, dword [esp + 0xa4]
push eax
push 1
push edx
call fcn.0041c440
add esp, 0x10
cmp dword [esp + 0x34], esi
jb 0x4214e0
mov eax, dword [esp + 0x20]
push eax
call fcn.0043c853
add esp, 4
lea esi, [esp + 0x38]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], edi
mov byte [esp + 0x20], 0
mov dword [esp + 0x98], 0xffffffff
call fcn.00429050
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.004298c0
mov dword [eax + 0x3c], edi
mov eax, 0x80004005
jmp 0x421527
call fcn.004298c0
mov dword [eax + 0x38], 0
xor eax, eax
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret 8
Function at 0x42c6b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4530eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0043c09e
push 4
mov dword [esp + 0x20], 0
call fcn.0043cb98
mov edi, eax
add esp, 4
test edi, edi
je 0x42c72e
call fcn.0043ba77
mov dword [edi], eax
call fcn.0043b8a5
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0043bbc7
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x42c723
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0043bbef
jmp 0x42c730
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4