joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c20
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], vtable.JThread.0
push edi
cmp byte [esi + 0x18], bl
je 0x412c3e
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 0x10], bl
jne 0x412c4e
cmp byte [esi + 0x18], bl
je 0x412c6b
mov ecx, dword [esi + 0x14]
push ecx
jmp 0x412c65
mov edx, dword [esi + 4]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0x10], bl
cmp byte [esi + 0x18], bl
je 0x412c6b
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x28], bl
je 0x412c82
mov ecx, dword [esi + 0x24]
push ecx
mov byte [esi + 0x28], bl
call edi
mov dword [esi + 0x24], ebx
cmp byte [esi + 0x20], bl
je 0x412c93
mov edx, dword [esi + 0x1c]
push edx
mov byte [esi + 0x20], bl
call edi
mov dword [esi + 0x1c], ebx
cmp byte [esi + 0x18], bl
je 0x412ca4
mov eax, dword [esi + 0x14]
push eax
mov byte [esi + 0x18], bl
call edi
mov dword [esi + 0x14], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x412cb0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
cmp byte [esi + 0x2c], 0
push ebx
push edi
jne 0x412d0b
cmp byte [esi + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov bl, 1
jne 0x412cd8
push 0
push 0
push 0
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x412d3d
mov byte [esi + 0x18], bl
cmp byte [esi + 0x20], 0
jne 0x412cf0
push 0
push 0
push 0
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x412d3d
mov byte [esi + 0x20], bl
cmp byte [esi + 0x28], 0
jne 0x412d08
push 0
push 0
push 0
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x412d3d
mov byte [esi + 0x28], bl
mov byte [esi + 0x2c], bl
cmp byte [esi + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x412d1f
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call edi
cmp byte [esi + 0x10], 0
je 0x412d43
cmp byte [esi + 0x18], 0
je 0x412d35
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 0xfffffffb
pop ebx
ret
pop edi
or eax, 0xffffffff
pop ebx
ret
cmp byte [esi + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
je 0x412d55
mov edx, dword [esi + 0x14]
push edx
call ebx
cmp byte [esi + 0x20], 0
je 0x412d63
mov eax, dword [esi + 0x1c]
push 0xffffffffffffffff
push eax
call edi
mov eax, dword [esi + 4]
test eax, eax
je 0x412d78
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
lea ecx, [esi + 8]
push ecx
push 0
push esi
push 0x412e20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x412da8
cmp byte [esi + 0x20], al
je 0x412da0
mov edx, dword [esi + 0x1c]
push edx
call ebx
pop edi
mov eax, 0xfffffffe
pop ebx
ret
cmp byte [esi + 0x18], 0
je 0x412db6
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call edi
cmp byte [esi + 0x10], 0
jne 0x412de0
lea esp, [esp]
cmp byte [esi + 0x18], 0
je 0x412dda
mov ecx, dword [esi + 0x14]
push ecx
call ebx
cmp byte [esi + 0x18], 0
je 0x412dda
mov edx, dword [esi + 0x14]
push 0xffffffffffffffff
push edx
call edi
cmp byte [esi + 0x10], 0
je 0x412dc0
cmp byte [esi + 0x18], 0
je 0x412dec
mov eax, dword [esi + 0x14]
push eax
call ebx
cmp byte [esi + 0x20], 0
je 0x412df8
mov ecx, dword [esi + 0x1c]
push ecx
call ebx
cmp byte [esi + 0x28], 0
je 0x412e12
mov edx, dword [esi + 0x24]
push 0xffffffffffffffff
push edx
call edi
cmp byte [esi + 0x28], 0
je 0x412e12
mov eax, dword [esi + 0x24]
push eax
call ebx
pop edi
xor eax, eax
pop ebx
ret

Function at 0x413017
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c070]
jne 0x413021
repz ret
jmp fcn.004155d6
Function at 0x420539
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00416252
and dword [ebp - 4], 0
cmp dword [0x42dc68], 0
mov ebx, eax
jne 0x4205ea
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42069b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42069b
push eax
call fcn.004161e0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42dc68], eax
call esi
push eax
call fcn.004161e0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42dc6c], eax
call esi
push eax
call fcn.004161e0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42dc70], eax
call esi
push eax
call fcn.004161e0
pop ecx
mov dword [0x42dc78], eax
test eax, eax
je 0x4205ea
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004161e0
pop ecx
mov dword [0x42dc74], eax
mov eax, dword [0x42dc74]
cmp eax, ebx
je 0x420642
cmp dword [0x42dc78], ebx
je 0x420642
push eax
call fcn.0041625b
push dword [0x42dc78]
mov esi, eax
call fcn.0041625b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x420642
test edi, edi
je 0x420642
call esi
test eax, eax
je 0x420639
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x420639
test byte [ebp - 0xc], 1
jne 0x420642
or dword [ebp + 0x10], 0x200000
jmp 0x42067b
mov eax, dword [0x42dc6c]
cmp eax, ebx
je 0x42067b
push eax
call fcn.0041625b
pop ecx
test eax, eax
je 0x42067b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42067b
mov eax, dword [0x42dc70]
cmp eax, ebx
je 0x42067b
push eax
call fcn.0041625b
pop ecx
test eax, eax
je 0x42067b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42dc68]
call fcn.0041625b
pop ecx
test eax, eax
je 0x42069b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42069d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402134
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x4e76fc], 0
jne 0x4021d5
mov eax, str._dbg.g_threadCallStack_tls
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00402243
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402175
push ebx
call fcn.00488e54
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x4e76fc], eax
cmp dword [0x4e76fc], 0
jne 0x4021d5
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4021a9
push 6
call fcn.00488e60
add esp, 4
mov dword [0x4e76fc], eax
push dword [0x4e76fc]
mov eax, str._dbg.g_threadCallStack_tls
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004026bd
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4021d5
push ebx
call fcn.00488e54
add esp, 4
mov dword [ebp - 8], esp
push dword [0x4e76fc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4021fa
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402237
call fcn.004027b8
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x4e76fc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402237
push 6
call fcn.00488e60
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x40223f
mov esp, ebp
pop ebp
ret
Function at 0x4022cd
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x4e7700], 0
jne 0x4024dc
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.00489a20
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40231f
push ebx
call fcn.00488e54
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402342
push 6
call fcn.00488e60
add esp, 4
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00489ad0
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.00402271
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x402387
push ebx
call fcn.00488e54
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4023b1
push 6
call fcn.00488e60
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4023c1
push ebx
call fcn.00488e54
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4023d4
mov eax, 0x4bb9b1
push eax
push 1
mov ebx, 0x164
call fcn.00489da0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.004018fa
mov dword [0x4e7700], eax
cmp dword [0x4e7700], 0
jne 0x4024dc
call fcn.004024fc
mov dword [0x4e7700], eax
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402430
push 6
call fcn.00488e60
add esp, 4
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00489ad0
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.00402271
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x402475
push ebx
call fcn.00488e54
add esp, 4
push 0x80000301
push 0
push dword [0x4e7700]
push 1
mov ebx, 0x168
call fcn.00489ad0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x4024bc
push 6
call fcn.00488e60
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4024cc
push ebx
call fcn.00488e54
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4024dc
push ebx
call fcn.00488e54
add esp, 4
mov eax, dword [0x4e7700]
jmp 0x4024e6
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4024f7
push ebx
call fcn.00488e54
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x402ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x402bda
push 6
call fcn.00488e60
add esp, 4
jmp 0x402bdf
mov esp, ebp
pop ebp
ret 4
Function at 0x40d9db
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40da08
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x40da1c
mov esp, ebp
pop ebp
ret 4

Function at 0x40da22
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40da4f
push 6
call fcn.00488e60
add esp, 4
jmp 0x40da54
mov esp, ebp
pop ebp
ret 4

Function at 0x40dd71
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40dd9e
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x40ddb2
mov esp, ebp
pop ebp
ret 4

Function at 0x40ddb8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40dde5
push 6
call fcn.00488e60
add esp, 4
jmp 0x40ddea
mov esp, ebp
pop ebp
ret 4
Function at 0x41119c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
jne 0x4111c5
call fcn.0041125d
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4111f1
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41121b
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [0x4e77f4]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41124f
push 6
call fcn.00488e60
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x411257
mov esp, ebp
pop ebp
ret 8
Function at 0x42187e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
jne 0x4218a7
call fcn.0041855b
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4218d3
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4218fd
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [0x4e77d4]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x421931
push 6
call fcn.00488e60
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x421939
mov esp, ebp
pop ebp
ret 8

Function at 0x4259bb
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4259ed
push 6
call fcn.00488e60
add esp, 4
jmp 0x4259f2
mov esp, ebp
pop ebp
ret 8
Function at 0x43ea68
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x43ea9d
push 6
call fcn.00488e60
add esp, 4
jmp 0x43eaa2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4402d1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
jne 0x4402fa
call fcn.004402a0
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x440326
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x440350
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [0x4e77c4]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x440384
push 6
call fcn.00488e60
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x44038c
mov esp, ebp
pop ebp
ret 8

Function at 0x446383
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4463b0
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x4463c4
mov esp, ebp
pop ebp
ret 4

Function at 0x4463ca
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4463f7
push 6
call fcn.00488e60
add esp, 4
jmp 0x4463fc
mov esp, ebp
pop ebp
ret 4

Function at 0x447c2e
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x447c63
push 6
call fcn.00488e60
add esp, 4
jmp 0x447c68
mov esp, ebp
pop ebp
ret 0x10
Function at 0x450579
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4505a6
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x4505ba
mov esp, ebp
pop ebp
ret 4

Function at 0x4505c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4505ed
push 6
call fcn.00488e60
add esp, 4
jmp 0x4505f2
mov esp, ebp
pop ebp
ret 4

Function at 0x451110
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x451145
push 6
call fcn.00488e60
add esp, 4
jmp 0x45114a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45dcd1
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x4e77a4], 0
jne 0x45dee0
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.00489a20
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x45dd23
push ebx
call fcn.00488e54
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x45dd46
push 6
call fcn.00488e60
add esp, 4
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00489ad0
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.00402271
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x45dd8b
push ebx
call fcn.00488e54
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x45ddb5
push 6
call fcn.00488e60
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x45ddc5
push ebx
call fcn.00488e54
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x45ddd8
mov eax, 0x4bb9b1
push eax
push 1
mov ebx, 0x164
call fcn.00489da0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.004018fa
mov dword [0x4e77a4], eax
cmp dword [0x4e77a4], 0
jne 0x45dee0
call fcn.0045df00
mov dword [0x4e77a4], eax
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x45de34
push 6
call fcn.00488e60
add esp, 4
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00489ad0
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.00402271
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x45de79
push ebx
call fcn.00488e54
add esp, 4
push 0x80000301
push 0
push dword [0x4e77a4]
push 1
mov ebx, 0x168
call fcn.00489ad0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x45dec0
push 6
call fcn.00488e60
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x45ded0
push ebx
call fcn.00488e54
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x45dee0
push ebx
call fcn.00488e54
add esp, 4
mov eax, dword [0x4e77a4]
jmp 0x45deea
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x45defb
push ebx
call fcn.00488e54
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x45e6c3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x45e6fd
push 6
call fcn.00488e60
add esp, 4
jmp 0x45e702
mov esp, ebp
pop ebp
ret 4
Function at 0x461fe7
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x4e77b0], 0
jne 0x462088
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0045dca3
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x462028
push ebx
call fcn.00488e54
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x4e77b0], eax
cmp dword [0x4e77b0], 0
jne 0x462088
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x46205c
push 6
call fcn.00488e60
add esp, 4
mov dword [0x4e77b0], eax
push dword [0x4e77b0]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0045e0c1
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x462088
push ebx
call fcn.00488e54
add esp, 4
mov dword [ebp - 8], esp
push dword [0x4e77b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4620ad
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4620ea
call fcn.0045df00
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x4e77b0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4620ea
push 6
call fcn.00488e60
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x4620f2
mov esp, ebp
pop ebp
ret

Function at 0x462472
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x4e77b4], 0
jne 0x462513
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00462581
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4624b3
push ebx
call fcn.00488e54
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x4e77b4], eax
cmp dword [0x4e77b4], 0
jne 0x462513
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4624e7
push 6
call fcn.00488e60
add esp, 4
mov dword [0x4e77b4], eax
push dword [0x4e77b4]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0046299f
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x462513
push ebx
call fcn.00488e54
add esp, 4
mov dword [ebp - 8], esp
push dword [0x4e77b4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x462538
push 6
call fcn.00488e60
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x462575
call fcn.004627de
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x4e77b4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x462575
push 6
call fcn.00488e60
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x46257d
mov esp, ebp
pop ebp
ret