joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x4211b2
push 0
push 0xa1
push str.c:libpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.0040cd70
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x4211bd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4211d1
shr eax, 4
and eax, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00420e40
int3

Function at 0x421540
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4783d8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 0
mov edi, dword [ebp + 8]
jne 0x42158e
push 0
push 0x134
push str.c:libpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.0040cd70
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0040f080
add esp, 8
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea eax, [esi + 0x1c]
cmovae ecx, dword [ebp - 0x28]
cmp dword [eax + 0x14], 8
jb 0x4215c8
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x4215dd
lea eax, [esi + 4]
push eax
call fcn.00420e40
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4215f2
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407075
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret 4
Function at 0x4260a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478719
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x74], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x4260fe
mov eax, dword [esi]
jmp 0x426100
mov eax, esi
mov byte [eax], 0
push 0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x70], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x4261c4
xor ecx, ecx
mov dword [ebp - 0x20], ebx
mov edx, 2
mov dword [ebp - 0x1c], ebx
mul edx
mov byte [ebp - 0x14], 1
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004448df
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
push edi
push ebx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4261b7
cmp eax, ebx
ja 0x4261b7
push esi
push edi
call fcn.0040f260
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x42617b
mov eax, dword [esi]
jmp 0x42617d
mov eax, esi
cmp byte [eax + ecx - 1], 0x5c
je 0x426190
push 0x4820a0
mov ecx, esi
call fcn.00406c5e
push edi
call fcn.00443c74
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret
push edi
mov byte [ebp - 4], 0
call fcn.00443c74
add esp, 4
push 0x1c
push str.Cannot_get_current_directory
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00406dcc
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x6c]
call fcn.00413bd0
push 0x4b0734
lea eax, [ebp - 0x6c]
push eax
call fcn.004463ed
int3
Function at 0x426d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478924
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7fff
mov dword [ebp - 0x70], 0
mov edx, 2
mov dword [ebp - 4], 0
mul edx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x84], 0x7fff
seto cl
mov dword [ebp - 0x80], 0x7fff
neg ecx
mov byte [ebp - 0x78], 1
or ecx, eax
push ecx
call fcn.004448df
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
push 0x7fff
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x426ec5
push 0x7fff
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x426e3f
push str.Cannot_get_system_directory_long_path_name
lea ecx, [ebp - 0x28]
call fcn.00406c87
mov byte [ebp - 4], 2
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00413bd0
push 0x4b0734
lea eax, [ebp - 0x6c]
push eax
call fcn.004463ed
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x426e65
mov eax, dword [esi]
jmp 0x426e67
mov eax, esi
mov byte [eax], 0
push esi
push edi
mov dword [ebp - 0x70], 1
call fcn.0040f260
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x426e88
mov eax, dword [esi]
jmp 0x426e8a
mov eax, esi
cmp byte [eax + ecx - 1], 0x5c
je 0x426e9f
push 1
push 0x4820a0
mov ecx, esi
call fcn.00406edb
push edi
call fcn.00443c74
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret
push 0x23
push str.Cannot_get_temporary_directory_path
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00406dcc
mov byte [ebp - 4], 3
jmp 0x426e23
Function at 0x426f10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478924
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7fff
mov dword [ebp - 0x70], 0
mov edx, 2
mov dword [ebp - 4], 0
mul edx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x84], 0x7fff
seto cl
mov dword [ebp - 0x80], 0x7fff
neg ecx
mov byte [ebp - 0x78], 1
or ecx, eax
push ecx
call fcn.004448df
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
push edi
push 0x7fff
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x427065
push 0x7fff
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x426fdf
push str.Cannot_get_temporary_directory_long_path_name
lea ecx, [ebp - 0x28]
call fcn.00406c87
mov byte [ebp - 4], 2
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00413bd0
push 0x4b0734
lea eax, [ebp - 0x6c]
push eax
call fcn.004463ed
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x427005
mov eax, dword [esi]
jmp 0x427007
mov eax, esi
mov byte [eax], 0
push esi
push edi
mov dword [ebp - 0x70], 1
call fcn.0040f260
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x427028
mov eax, dword [esi]
jmp 0x42702a
mov eax, esi
cmp byte [eax + ecx - 1], 0x5c
je 0x42703f
push 1
push 0x4820a0
mov ecx, esi
call fcn.00406edb
push edi
call fcn.00443c74
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret
push 0x23
push str.Cannot_get_temporary_directory_path
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00406dcc
mov byte [ebp - 4], 3
jmp 0x426fc3
Function at 0x4270b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478d88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4b72d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040ae60
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edx
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
call fcn.004448df
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x38]
dec ecx
mov dword [eax], edx
add ecx, edx
mov eax, dword [esi + 0x20]
sub ecx, edx
mov dword [eax], edx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x428e30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478d88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4b72d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040ae60
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edx
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedBidirectionalStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
call fcn.004448df
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
call fcn.004448df
mov ecx, dword [esi + 0x40]
add esp, 8
mov dword [esi + 0x44], eax
add ecx, 4
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x44]
mov ecx, dword [esi + 0x38]
dec ecx
mov dword [eax], edx
add ecx, edx
mov eax, dword [esi + 0x20]
sub ecx, edx
mov dword [eax], edx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x68], 0xffffffff
je 0x4299aa
mov eax, dword [esi + 0x48]
test al, 1
je 0x4299aa
test al, 2
je 0x42996d
mov eax, dword [esi]
call dword [eax + 0x34]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x429999
lea eax, [esi + 0x50]
push eax
call fcn.00420e30
add esp, 4
mov eax, dword [ebp - 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
mov esp, ebp
pop ebp
ret 0xc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x429c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [esi + 0x68]
cmp ecx, 0xffffffff
je 0x429d32
mov eax, dword [esi + 0x48]
test al, 2
je 0x429d32
test al, 8
je 0x429cf5
push 2
lea eax, [ebp - 8]
xorps xmm0, xmm0
push eax
push 0
push ecx
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x429cec
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x429ce9
lea eax, [esi + 0x50]
push eax
call fcn.00420e30
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x70], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x74], eax
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x429d21
lea eax, [esi + 0x50]
push eax
call fcn.00420e30
add esp, 4
mov eax, dword [ebp - 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
mov esp, ebp
pop ebp
ret 0xc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42ac20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4790fc
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push ebx
call fcn.0040f080
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x42acba
push eax
push ebx
lea ecx, [ebp - 0x6c]
call fcn.00413600
push 0x4b015c
lea eax, [ebp - 0x6c]
push eax
call fcn.004463ed
xor ebx, ebx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], ebx
mov byte [ebp - 0x74], 1
test edi, edi
je 0x42aceb
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004448df
mov ebx, eax
add esp, 4
mov dword [ebp - 0x78], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x42ad29
mov eax, dword [esi]
jmp 0x42ad2b
mov eax, esi
mov byte [eax], 0
push esi
lea eax, [edi - 1]
mov dword [ebp - 0x70], 1
push eax
push ebx
call fcn.0040f2a0
push ebx
call fcn.00443c74
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, 8
jb 0x42ad5e
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407075
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret

Function at 0x42ad80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ad90

Function at 0x42ad90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479138
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.0040f080
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x14]
test eax, eax
setne bl
cmp ecx, 8
jb 0x42ae10
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407075
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret
Function at 0x42ae70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47918a
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x94], 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x90], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x42af1a
push 0x18
push str.Cannot_get_computer_name
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x48], al
call fcn.00406dcc
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x8c]
call fcn.00413bd0
push 0x4b0734
lea eax, [ebp - 0x8c]
push eax
call fcn.004463ed
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x42af40
mov eax, dword [esi]
jmp 0x42af42
mov eax, esi
mov byte [eax], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push esi
push eax
mov dword [ebp - 0x94], 1
call fcn.0040f260
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret

Function at 0x42afa0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x28]
cmp eax, 0xa
ja case.0x42afc5.4
jmp dword [eax*4 + 0x42b088]
mov ecx, dword [ebp + 8]
push str.IA32
call fcn.00406c87
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push str.MIPS
call fcn.00406c87
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push str.ALPHA
call fcn.00406c87
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 0x4824e0
call fcn.00406c87
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push str.IA64
call fcn.00406c87
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push str.IA64_32
call fcn.00406c87
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push str.AMD64
call fcn.00406c87
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, esi
push 7
push str.Unknown
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.00406dcc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42b9d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4792f3
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x74], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea ecx, [esi + 4]
mov dword [esi], eax
call fcn.00415f50
cmp dword [esi], 0xffffffff
mov dword [ebp - 4], 0
jne 0x42ba5e
push 0x22
push str.cannot_allocate_thread_context_key
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00406dcc
push 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x6c]
call fcn.00413bd0
push 0x4b0734
lea eax, [ebp - 0x6c]
push eax
call fcn.004463ed
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret

Function at 0x42c0f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479397
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4b72d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 4]
mov dword [ebp - 0x10], ecx
call fcn.00408ec0
push dword [edi]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x42c164
push 8
call fcn.00443736
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x42c159
mov ecx, eax
call fcn.0042ba90
mov esi, eax
jmp 0x42c15b
xor esi, esi
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x10]
call fcn.00411460
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434690
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x43469c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004346b0

Function at 0x43a830
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a3a8
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0043a790
push 0
push 0
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x43a8bc
push 0x14
push str.cannot_start_service
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00406dcc
push 0
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xa0]
call fcn.00413ba0
push 0x4b0734
lea eax, [ebp - 0xa0]
push eax
call fcn.004463ed
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea eax, [ebp - 0x44]
push eax
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x43a8f0
cmp dword [ebp - 0x40], 2
jne 0x43a8f0
push 0xfa
call ebx
add esi, 0xfa
cmp esi, 0x7530
jl 0x43a8c4
lea eax, [ebp - 0x44]
push eax
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x43a938
push str.cannot_query_status_of_starting_service
lea ecx, [ebp - 0x28]
call fcn.00406c87
push 0
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0xa0]
call fcn.00413ba0
push 0x4b0734
lea eax, [ebp - 0xa0]
push eax
call fcn.004463ed
cmp dword [ebp - 0x40], 4
je 0x43a975
push str.service_failed_to_start_within_a_reasonable_time
lea ecx, [ebp - 0x5c]
call fcn.00406c87
push 0
push edi
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0xe4]
call fcn.00413ba0
push 0x4b0734
lea eax, [ebp - 0xe4]
push eax
call fcn.004463ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret

Function at 0x43a9a0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a3d8
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4b72d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0043a790
lea eax, [ebp - 0x44]
push eax
push 1
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x43aa29
push 0x13
push str.cannot_stop_service
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00406dcc
push 0
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x88]
call fcn.00413ba0
push 0x4b0734
lea eax, [ebp - 0x88]
push eax
call fcn.004463ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443725
mov esp, ebp
pop ebp
ret
Function at 0x45b7a9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045b626

Function at 0x45f614
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f2ae