joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417c70
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x400
push ebx
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [esp + 0xc]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417ca0
mov edi, dword [esp + 0x14]
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417cb4
sub eax, esi
lea ecx, [eax + edx + 0x28]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [esp + 0xc]
push edx
push ebx
push edi
mov esi, eax
push str._s_failed_with_error__d:__s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push str.Error
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x417d10
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push esi
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x417d36
pop esi
pop ebx
add esp, 0xc
ret
push ebp
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esp + 0x2c]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x417d81
push str.Installer_:_Wrapper.CreateFile
call fcn.00417c70
xor esi, esi
test edi, edi
je 0x417dd1
mov dword [esp + 0x18], 0x2000
nop
mov eax, edi
sub eax, esi
mov dword [esp + 0x14], eax
cmp eax, 0x2000
mov dword [esp + 0x10], 0
lea eax, [esp + 0x14]
jb 0x417daf
lea eax, [esp + 0x18]
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x417de6
mov eax, dword [esp + 0x10]
add esi, eax
add ebx, eax
cmp esi, edi
jb 0x417d90
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x417df0
push str.Installer_:_Wrapper.CloseHandle
call fcn.00417c70
push str.Installer_:_Wrapper.WriteFile__In_small_chunks_
call fcn.00417c70
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x419ed0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x419ef8
push esi
call fcn.004386a0
add esp, 4
test eax, eax
je 0x419ef8
push 0
push esi
call fcn.0043b830
add esp, 8
pop esi
ret

Function at 0x419f00
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x81c
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x818], eax
push ebp
xor ebp, ebp
push esi
mov esi, dword [esp + 0x828]
push 0x7ff
lea eax, [esp + 0x25]
push ebp
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c], 0
call fcn.004547c0
add esp, 0xc
push 0x2001f
push 0x4851d4
push 0x80000002
lea ecx, [esp + 0x14]
call fcn.004018c0
test eax, eax
je 0x419f93
mov eax, dword [esp + 8]
cmp eax, ebp
je 0x419f7a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.0045407e
add esp, 0x81c
ret
push edi
push 0x2001f
cmp dword [esp + 0x834], ebp
jne 0x419feb
mov edi, dword [esp + 0x10]
push 0x485250
push edi
lea ecx, [esp + 0x24]
call fcn.004018c0
test eax, eax
je 0x41a038
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x419fca
push eax
call esi
cmp edi, ebp
je 0x419fd1
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.0045407e
add esp, 0x81c
ret
mov ecx, dword [esp + 0x10]
push str.Java_Development_Kit
push ecx
lea ecx, [esp + 0x24]
call fcn.004018c0
test eax, eax
je 0x41a038
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x41a013
push eax
call esi
mov eax, dword [esp + 0xc]
cmp eax, ebp
je 0x41a01e
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.0045407e
add esp, 0x81c
ret
mov edi, dword [esp + 0x18]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x400
lea edx, [esp + 0x2c]
push edx
push ebp
push edi
mov byte [esi], 0
call ebx
test eax, eax
jne 0x41a08a
push esi
lea eax, [esp + 0x2c]
push eax
inc ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jle 0x41a078
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push 0x400
lea edx, [esp + 0x2c]
push edx
push ebp
push edi
call ebx
test eax, eax
je 0x41a058
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
test edi, edi
je 0x41a098
push edi
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41a0a3
push eax
call esi
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0045407e
add esp, 0x81c
ret
Function at 0x41a0c0
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x470a7b
mov eax, dword fs:[0]
push eax
sub esp, 0x640
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x63c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x654]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x664]
mov esi, dword [esp + 0x668]
xor ebx, ebx
push 0x30b
lea eax, [esp + 0x13d]
push ebx
push eax
mov byte [esp + 0x144], bl
call fcn.004547c0
push esi
push ebp
lea ecx, [esp + 0x14c]
push str.___Start_in_CopyFileOnReboot:__s_to__s___
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x41a1ce
call fcn.00434cf0
mov edi, eax
lea eax, [esp + 0x138]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41a170
sub eax, edx
push eax
lea edx, [esp + 0x13c]
push edx
lea ecx, [esp + 0x1c]
call fcn.004042b0
lea eax, [esp + 0x14]
push eax
push 0x485118
push 0x285
push 0x485130
push 1
mov ecx, edi
mov dword [esp + 0x670], ebx
call fcn.00434dd0
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x65c], 0xffffffff
jb 0x41a1ce
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004533ae
add esp, 4
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea edx, [esp + 0x550]
push str._s..
push edx
call edi
add esp, 0xc
cmp esi, ebx
je 0x41a20b
push ebx
lea eax, [esp + 0x448]
push eax
push 0x105
lea ecx, [esp + 0x558]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp eax, ebx
jne 0x41a212
xor eax, eax
jmp 0x41a29d
lea edx, [esp + 0x30]
push edx
push ebx
push 0x48512c
lea eax, [esp + 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x41a20b
push ebx
lea ecx, [esp + 0x34]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41a20b
push esi
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x140]
push str._____CopyFileOnReboot:__s_to__s_____
push eax
call edi
add esp, 0x10
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x41a28f
lea ecx, [esp + 0x138]
push ecx
push str.CopyFileOnReboot
push 0x294
push 0x4851e8
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.004053c0
lea edx, [esp + 0x30]
push esi
push edx
call fcn.0043b830
add esp, 8
mov ecx, dword [esp + 0x654]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x63c]
xor ecx, esp
call fcn.0045407e
add esp, 0x64c
ret

Function at 0x41a2d0
Capabilities:
Copy file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x41a2f2
push esi
push edi
call fcn.0041a0c0
add esp, 8
pop edi
pop esi
ret
Function at 0x41e920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4710b0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x3c]
push eax
call fcn.0042c920
xor ebx, ebx
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.004040c0
lea eax, [esi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push eax
mov byte [esp + 0x3c], 1
call fcn.00429ff0
add esp, 8
cmp dword [esp + 0x24], 0x10
jb 0x41e9a2
mov edx, dword [esp + 0x10]
push edx
call fcn.004533ae
add esp, 4
mov eax, esi
mov byte [esi + 0x38], bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret 4
Function at 0x41f340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x471248
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x30]
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push edi
mov ecx, esi
call edx
mov ecx, dword [esp + 0x34]
mov eax, dword [esi]
mov edx, dword [eax + 4]
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, dword [eax + 8]
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x40]
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x24]
cmp edx, ecx
je 0x41f3d1
mov eax, ecx
cmp ecx, ecx
je 0x41f3ce
mov edi, edi
mov ebx, dword [eax]
mov dword [edx], ebx
add eax, 4
add edx, 4
cmp eax, ecx
jne 0x41f3c0
mov dword [edi + 0x28], edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov ebx, eax
mov dword [esp + 0x34], ebx
mov eax, dword [edi + 4]
push ebx
push eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x34], 0
call fcn.00427690
mov esi, dword [eax]
mov dword [eax], 0
mov ecx, dword [edi + 4]
add esp, 0xc
cmp esi, ecx
je 0x41f415
test ecx, ecx
je 0x41f415
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x30]
mov dword [edi + 4], esi
test ecx, ecx
je 0x41f428
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [edi + 0x28]
sub ecx, dword [edi + 0x24]
test ecx, 0xfffffffc
je 0x41f46b
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0x479488
call fcn.00453b7a
push 0x498418
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], vtable.settings::Exception.0
mov dword [esp + 0x24], 0x139
call fcn.00453ce8
mov dword [esp + 0x28], 0xffffffff
test ebx, ebx
je 0x41f481
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x14

Function at 0x41f700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4712c0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0xc]
call fcn.0042e930
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0041f340
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x28], 1
test ecx, ecx
je 0x41f774
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 0x14
Function at 0x426d70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x472019
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x30]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 1
call fcn.0043e3f0
mov edi, dword [edi + 8]
mov ebp, dword [edi]
mov dword [esp + 0x1c], edi
cmp ebp, edi
je 0x426ef3
cmp dword [ebp + 0x20], 0x10
jb 0x426dde
mov edi, dword [ebp + 0xc]
jmp 0x426de1
lea edi, [ebp + 0xc]
mov eax, dword [esi + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edi
cmp ecx, eax
jae 0x426e53
mov edx, dword [esi]
cmp edx, ecx
ja 0x426e53
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x426e41
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x426f0b
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x426e41
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x426e31
xor ecx, ecx
jmp 0x426e33
add ecx, edx
cmp ecx, eax
jae 0x426e39
mov ecx, eax
push ecx
mov ecx, esi
call fcn.0043e3f0
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea ecx, [edx + edi*4]
test eax, eax
je 0x426ea2
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x426ea2
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x426e99
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x426f0b
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x426e99
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x426e89
xor ecx, ecx
jmp 0x426e8b
add ecx, edx
cmp ecx, eax
jae 0x426e91
mov ecx, eax
push ecx
mov ecx, esi
call fcn.0043e3f0
mov eax, dword [esi + 4]
test eax, eax
je 0x426ea2
mov dword [eax], edi
add dword [esi + 4], 4
cmp byte [ebp + 0x2d], 0
jne 0x426ee9
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x2d], 0
jne 0x426ece
mov eax, dword [ecx]
cmp byte [eax + 0x2d], 0
jne 0x426eca
lea ecx, [ecx]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x2d], 0
je 0x426ec0
mov ebp, ecx
jmp 0x426ee9
mov eax, dword [ebp + 4]
cmp byte [eax + 0x2d], 0
jne 0x426ee7
cmp ebp, dword [eax + 8]
jne 0x426ee7
mov ebp, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x2d], 0
je 0x426ed7
mov ebp, eax
cmp ebp, dword [esp + 0x1c]
jne 0x426dd3
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push str.vector_T__too_long
call fcn.00440d57
int3
Function at 0x4273f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4720b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.settings_impl::ConfigBuilder.0
push 0x30
mov dword [esp + 0x28], 0
mov dword [esi + 0x1c], 0
call fcn.00453c68
add esp, 4
test eax, eax
je 0x42748d
mov dword [esi + 0x18], eax
mov dword [eax], eax
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x18]
mov al, 1
mov byte [ecx + 0x2c], al
mov edx, dword [esi + 0x18]
mov ecx, dword [esp + 0x38]
mov byte [edx + 0x2d], al
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 8], edx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 0x10
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0
call fcn.00453b7a
push 0x497ee0
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], vtable.std::bad_alloc.0
call fcn.00453ce8
int3

Function at 0x427c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4722b1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 1
call fcn.0043e570
mov edx, dword [esp + 0x38]
push 1
lea ecx, [esp + 0x18]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.004277c0
mov ecx, dword [eax]
mov edi, dword [esp + 0x44]
mov dword [eax], esi
add esp, 0x10
mov dword [edi], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], 1
cmp ecx, esi
je 0x427cc8
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x427cd9
push eax
call fcn.004533ae
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x428aa0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4722db
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004415ae
push 4
mov dword [esp + 0x24], 0
call fcn.00453c68
mov edi, eax
add esp, 4
test edi, edi
je 0x428b22
call fcn.00441217
mov dword [edi], eax
call fcn.00441092
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00440fc7
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x428b17
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00440fef
jmp 0x428b24
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x42b9b0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x472739
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x10], edi
mov esi, dword [esp + 0x90]
push 0x2c
mov dword [esp + 0x8c], edi
mov dword [esp + 0x2c], 0x48b12c
mov dword [esp + 0x30], 0x48b130
mov dword [esp + 0x34], 0x48b134
mov dword [esp + 0x38], 0x48b138
mov dword [esp + 0x3c], str.COM1
mov dword [esp + 0x40], str.COM2
mov dword [esp + 0x44], str.COM3
mov dword [esp + 0x48], str.COM4
mov dword [esp + 0x4c], str.COM5
mov dword [esp + 0x50], str.COM6
mov dword [esp + 0x54], str.COM7
mov dword [esp + 0x58], str.COM8
mov dword [esp + 0x5c], str.COM9
mov dword [esp + 0x60], str.LPT1
mov dword [esp + 0x64], str.LPT2
mov dword [esp + 0x68], str.LPT3
mov dword [esp + 0x6c], str.LPT4
mov dword [esp + 0x70], str.LPT5
mov dword [esp + 0x74], str.LPT6
mov dword [esp + 0x78], str.LPT7
mov dword [esp + 0x7c], str.LPT8
mov dword [esp + 0x80], str.LPT9
mov dword [esi + 8], edi
call fcn.00453c68
add esp, 4
cmp eax, edi
je 0x42bb1d
mov dword [esi + 4], eax
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov eax, dword [esi + 4]
mov byte [eax + 0x28], 1
mov ecx, dword [esi + 4]
mov byte [ecx + 0x29], 1
mov dword [esp + 0x88], edi
mov dword [esp + 0x10], 1
lea edi, [esp + 0x28]
mov ebp, 0x16
push 0
push edi
mov ecx, esi
call fcn.0042b1e0
push eax
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0042ab60
add edi, 4
dec ebp
jne 0x42bae8
mov eax, esi
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x7c
ret
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], edi
call fcn.00453b7a
push 0x497ee0
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], vtable.std::bad_alloc.0
call fcn.00453ce8
int3
Function at 0x42d4e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x472a96
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push esi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x264]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x274]
xor esi, esi
lea eax, [esp + 0x58]
push eax
push esi
push esi
push 0x23
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x42d56f
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0x479488
call fcn.00453b7a
push 0x498418
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], vtable.settings::Exception.0
mov dword [esp + 0x24], 0xc8
call fcn.00453ce8
xor eax, eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x58]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x42d590
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x28]
call fcn.004043a0
mov edx, dword [0x4a2c24]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x278], esi
call fcn.0042d480
push eax
push ebx
mov byte [esp + 0x280], 1
call fcn.0042a0e0
add esp, 0x14
cmp dword [esp + 0x50], 8
jb 0x42d5f1
mov edx, dword [esp + 0x3c]
push edx
call fcn.004533ae
add esp, 4
xor eax, eax
cmp dword [esp + 0x34], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], esi
mov word [esp + 0x3c], ax
jb 0x42d618
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004533ae
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x264]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.0045407e
add esp, 0x264
ret