joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ca05
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0041ccf0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41caa0
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4e814c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x41caa0
cmp eax, 1
je 0x41cac1
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41caa0
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x41ca6d
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x41ca9c
xor eax, eax
inc eax
jmp 0x41cae0
cmp edi, eax
jae 0x41caa4
xor eax, eax
jmp 0x41cae0
cmp eax, esi
jae 0x41caab
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4e814c]
jmp 0x41cac4
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41dcef
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x41dd0c
call fcn.0041e139
mov dword [eax], 0x16
xor eax, eax
jmp 0x41dd76
push esi
push 0x8c
push 1
call fcn.0041ebf3
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x41dd61
push esi
call fcn.004237be
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x41dd3f
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x41dc5a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41dd75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0041c994
test ebx, ebx
pop ecx
je 0x41dd73
push ebx
call fcn.0041e14b
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41edff
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x444d10
call fcn.00420828
mov edi, 0x94
mov eax, edi
call fcn.0041ccf0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4e814c], ecx
mov eax, dword [esi + 4]
mov dword [0x4e8158], eax
mov edx, dword [esi + 8]
mov dword [0x4e815c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4e8150], esi
cmp ecx, 2
je 0x41ee5f
or esi, 0x8000
mov dword [0x4e8150], esi
shl eax, 8
add eax, edx
mov dword [0x4e8154], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x41ee9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ee9a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41eeb2
cmp eax, 0x20b
je 0x41ee9f
mov dword [ebp - 0x1c], esi
jmp 0x41eec6
cmp dword [ecx + 0x84], 0xe
jbe 0x41ee9a
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x41eec0
cmp dword [ecx + 0x74], 0xe
jbe 0x41ee9a
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004215e7
pop ecx
test eax, eax
jne 0x41eeda
push 0x1c
call fcn.0041eddb
pop ecx
call fcn.004239b8
test eax, eax
jne 0x41eeeb
push 0x10
call fcn.0041eddb
pop ecx
call fcn.00425a80
mov dword [ebp - 4], esi
call fcn.00424a64
test eax, eax
jge 0x41ef04
push 0x1b
call fcn.0041edb6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4e8a30], eax
call fcn.0042595e
mov dword [0x4e8138], eax
call fcn.004258bc
test eax, eax
jge 0x41ef2a
push 8
call fcn.0041edb6
pop ecx
call fcn.00425689
test eax, eax
jge 0x41ef3b
push 9
call fcn.0041edb6
pop ecx
push 1
call fcn.0041f7c2
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x41ef51
push eax
call fcn.0041edb6
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0042562c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x41ef72
movzx eax, word [ebp - 0x40]
jmp 0x41ef75
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0042a56e
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x41ef93
push edi
call fcn.0041f8ef
call fcn.0041f911
jmp 0x41efc5
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00420863
ret
Function at 0x41f82c
Capabilities:
Terminate process

Disassembly:
push 8
push 0x444d80
call fcn.00420828
push 8
call fcn.0042159c
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4e818c], esi
jne 0x41f860
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4e8188], esi
mov al, byte [ebp + 0x10]
mov byte [0x4e8184], al
cmp dword [ebp + 0xc], edi
jne 0x41f8aa
cmp dword [0x4e8a28], edi
je 0x41f89a
mov eax, dword [0x4e8a24]
sub eax, 4
mov dword [0x4e8a24], eax
cmp eax, dword [0x4e8a28]
jb 0x41f89a
mov eax, dword [eax]
cmp eax, edi
je 0x41f87b
call eax
jmp 0x41f87b
push 0x44e0c4
mov eax, 0x44e0bc
call fcn.0041f7aa
pop ecx
push 0x44e0d0
mov eax, 0x44e0c8
call fcn.0041f7aa
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x41f8db
cmp dword [ebp + 0x10], edi
jne 0x41f8e9
mov dword [0x4e818c], esi
push dword [ebp + 8]
call fcn.0041f768
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x41f8e8
push 8
call fcn.004214e7
pop ecx
ret
call fcn.00420863
ret
Function at 0x422176
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4221a4
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4221ab
cmp ebx, dword [eax + 4]
jae 0x4221ab
xor eax, eax
jmp 0x42239b
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4221bc
xor eax, eax
inc eax
jmp 0x42239a
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4221d2
cmp ecx, edx
jae 0x422317
cmp dword [eax + 4], 0
je 0x4221db
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4221c3
cmp dword [ebp + 8], 0
je 0x4221fd
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x422317
cmp eax, esi
jae 0x422317
mov eax, dword [0x4e82f0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x422222
cmp dword [esi*4 + 0x4e82f8], edi
je 0x42231b
inc esi
cmp esi, eax
jl 0x422210
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x422397
cmp dword [ebp - 8], 0x1000000
jne 0x422397
test byte [ebp - 0xc], 0xcc
je 0x4222a0
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x422397
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x422397
cmp word [eax + 0x18], 0x10b
jne 0x422397
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x422397
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4222a0
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4222a0
test byte [ecx + 0x27], 0x80
jne 0x422317
push 1
push 0x4e8338
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4221b4
mov ecx, dword [0x4e82f0]
test ecx, ecx
mov edx, ecx
jle 0x4222d4
lea eax, [ecx*4 + 0x4e82f4]
cmp dword [eax], edi
je 0x4222d4
dec edx
sub eax, 4
test edx, edx
jg 0x4222c8
test edx, edx
jne 0x422305
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4222e1
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4222f9
lea eax, [edx*4 + 0x4e82f8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4222e7
cmp ecx, 0x10
jge 0x422305
inc ecx
mov dword [0x4e82f0], ecx
push 0
push 0x4e8338
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4221b4
xor eax, eax
jmp 0x42239a
test esi, esi
jle 0x4221b4
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x4e8338
call ebx
test eax, eax
jne 0x4221b4
cmp dword [esi*4 + 0x4e82f8], edi
je 0x422371
mov eax, dword [0x4e82f0]
lea esi, [eax - 1]
test esi, esi
jl 0x42235f
cmp dword [esi*4 + 0x4e82f8], edi
je 0x42235b
dec esi
jns 0x42234f
test esi, esi
jge 0x42236f
cmp eax, 0x10
jge 0x42236a
inc eax
mov dword [0x4e82f0], eax
lea esi, [eax - 1]
jmp 0x422371
je 0x422389
xor ecx, ecx
test esi, esi
jl 0x422389
lea eax, [ecx*4 + 0x4e82f8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x422377
push 0
push 0x4e8338
call ebx
jmp 0x4221b4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424cfd
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x494b80]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x424d2e
xor eax, eax
jmp 0x424eb7
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x4e86c0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x424d6a
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.00429064
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x424e45
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x424e83
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x424dce
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x424dbf
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x424d9f
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424e0e
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x424e17
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x424d90
jmp 0x424e19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x424eb2
cmp dword [ebp - 0x6c], edi
je 0x424e83
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x424e78
call fcn.0041e139
mov dword [eax], 9
call fcn.0041e142
mov dword [eax], esi
jmp 0x424ead
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424e6d
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x424e19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x424e19
push dword [ebp - 0x6c]
call fcn.0041e14b
pop ecx
jmp 0x424ead
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x424e9b
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x424e9b
xor eax, eax
jmp 0x424eb5
call fcn.0041e139
mov dword [eax], 0x1c
call fcn.0041e142
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x424eb5
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0041cd5e
add ebp, 0x3a0
leave
ret
Function at 0x42547c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x494b80]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x495520]
je 0x4254b1
inc eax
cmp eax, 0x13
jb 0x4254a2
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x495520]
jne 0x4255d7
mov eax, dword [0x4e8140]
cmp eax, 1
je 0x4255af
cmp eax, edx
jne 0x4254e1
cmp dword [0x494fa4], 1
je 0x4255af
cmp ecx, 0xfc
je 0x4255d7
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x425517
lea eax, [ebp - 0x80]
push 0x444ecc
push eax
call fcn.00426910
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0041f400
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42554b
mov eax, edi
push eax
call fcn.0041f400
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4400bc
push edi
call fcn.0041e6a0
add esp, 0x10
push edi
call fcn.0041f400
push dword [esi + 0x495524]
mov ebx, eax
call fcn.0041f400
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0041ccf0
mov ebx, esp
push 0x445fc0
push ebx
call fcn.00426910
push edi
push ebx
call fcn.00426920
push 0x444ec8
push ebx
call fcn.00426920
push dword [esi + 0x495524]
push ebx
call fcn.00426920
push 0x12010
push 0x444e94
push ebx
call fcn.00427d70
add esp, 0x2c
jmp 0x4255d7
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x495524]
push dword [esi]
call fcn.0041f400
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0041cd5e
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x426d0e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x426ee2
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x4e86c0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x426ee2
test cl, 0x48
je 0x426d79
cmp byte [eax + 5], 0xa
je 0x426d79
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426dcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x426db3
call fcn.0041e139
mov dword [eax], 9
call fcn.0041e142
mov dword [eax], esi
jmp 0x426dc3
cmp eax, 0x6d
je 0x426ee2
push eax
call fcn.0041e14b
pop ecx
or eax, 0xffffffff
jmp 0x426ee4
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x426edd
test eax, eax
je 0x426df2
cmp byte [ebx], 0xa
jne 0x426df2
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x426dfb
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x426ed7
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x426ec7
cmp al, 0xd
je 0x426e2d
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x426eb9
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x426e47
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x426e42
add dword [ebp + 0x10], 2
jmp 0x426e9b
mov dword [ebp + 0x10], eax
jmp 0x426eb5
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426e6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x426eb5
cmp dword [ebp - 0xc], 0
je 0x426eb5
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x426e90
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x426e9b
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x426eb8
cmp ebx, dword [ebp + 0xc]
jne 0x426ea0
cmp byte [ebp - 1], 0xa
jne 0x426ea0
mov byte [ebx], 0xa
jmp 0x426eb8
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00426f94
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x426eb9
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x426e11
jmp 0x426ed7
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x426ed7
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x426ee4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427a02
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x427a30
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x427a35
cmp eax, 1
je 0x427a35
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x427a39
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x494b80]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x427ab1
push ebx
call fcn.00427a02
test eax, eax
pop ecx
jne 0x427a80
call fcn.0041e142
mov dword [eax], 0xf
call fcn.0041e139
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0041cd5e
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x427ac3
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x427a73
inc eax
cmp eax, 0x104
ja 0x427a73
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x427afb
cmp eax, dword [ebp + 0x10]
jg 0x427ade
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041c982
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x427b10
call fcn.0041e139
mov dword [eax], 0xc
jmp 0x427a73
cmp eax, dword [ebp + 0x10]
jle 0x427b10
call fcn.0041e139
mov dword [eax], 0x22
jmp 0x427a73
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.00426910
pop ecx
pop ecx
jmp 0x427a75

Function at 0x427d70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4e85a4], ebx
push esi
push edi
jne 0x427df0
push 0x443cf4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x427e2b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44616c
push edi
call esi
test eax, eax
mov dword [0x4e85a4], eax
je 0x427e2b
push 0x44615c
push edi
call esi
push 0x446148
push edi
mov dword [0x4e85a8], eax
call esi
cmp dword [0x4e814c], 2
mov dword [0x4e85ac], eax
jne 0x427df0
push 0x44612c
push edi
call esi
test eax, eax
mov dword [0x4e85b4], eax
je 0x427df0
push 0x446114
push edi
call esi
mov dword [0x4e85b0], eax
mov eax, dword [0x4e85b0]
test eax, eax
je 0x427e35
call eax
test eax, eax
je 0x427e1c
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4e85b4]
test eax, eax
je 0x427e1c
test byte [ebp - 8], 1
jne 0x427e35
cmp dword [0x4e8158], 4
jb 0x427e2f
or byte [ebp + 0x12], 0x20
jmp 0x427e54
xor eax, eax
jmp 0x427e64
or byte [ebp + 0x12], 4
jmp 0x427e54
mov eax, dword [0x4e85a8]
test eax, eax
je 0x427e54
call eax
mov ebx, eax
test ebx, ebx
je 0x427e54
mov eax, dword [0x4e85ac]
test eax, eax
je 0x427e54
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4e85a4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42963c
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x429655
or eax, 0xffffffff
jmp 0x4296b6
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x4296b2
push 0x3d
push esi
call fcn.0041d6d8
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4296b2
cmp esi, eax
je 0x4296b2
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x4e816c]
sete cl
cmp eax, dword [0x4e8170]
mov dword [ebp - 8], ecx
jne 0x429698
mov edi, eax
call fcn.004295db
mov dword [0x4e816c], eax
cmp eax, ebx
jne 0x4296f1
cmp dword [ebp + 0xc], ebx
je 0x4296ba
cmp dword [0x4e8174], ebx
je 0x4296ba
call fcn.004253ec
test eax, eax
je 0x4296f1
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x4296c3
xor eax, eax
jmp 0x4296b5
push 4
call fcn.0041c982
cmp eax, ebx
pop ecx
mov dword [0x4e816c], eax
je 0x4296b2
mov dword [eax], ebx
cmp dword [0x4e8174], ebx
jne 0x4296f1
push 4
call fcn.0041c982
cmp eax, ebx
pop ecx
mov dword [0x4e8174], eax
je 0x4296b2
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x4e816c]
call fcn.0042958e
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x429752
cmp dword [esi], ebx
je 0x429752
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0041c994
cmp dword [ebp - 8], ebx
pop ecx
jne 0x429735
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x429793
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x42972c
mov eax, edi
shl eax, 2
push eax
push dword [0x4e816c]
call fcn.0041f4c5
cmp eax, ebx
pop ecx
pop ecx
je 0x429793
jmp 0x42978e
cmp dword [ebp - 8], ebx
jne 0x4297fe
cmp edi, ebx
jge 0x429761
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x4e816c]
call fcn.0041f4c5
cmp eax, ebx
pop ecx
pop ecx
je 0x4296b2
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x4e816c], eax
cmp dword [ebp + 0xc], ebx
je 0x4297e8
push dword [ebp - 4]
call fcn.0041f400
inc eax
inc eax
push eax
call fcn.0041c982
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x4297e8
push dword [ebp - 4]
push esi
call fcn.00426910
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4297e1
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0041c994
pop ecx
cmp dword [ebp - 8], ebx
je 0x4297f6
push dword [ebp - 4]
call fcn.0041c994
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4296b5
push dword [ebp - 4]
call fcn.0041c994
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x4296bf