joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a67c
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42a724
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42a6d9
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x6f62
push 0x273
push 0x2215
push 1
push 0x7383
call fcn.0042a73c
add esp, 0x18
jmp 0x42a722
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42a6fe
push 0
push 0x132f
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x42a722
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42a722
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x42a738
push 1
push 0x34f6
push 0x2482
call fcn.0041d10f
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x441c95
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3a2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x441db7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x327e
mov dword [ebp - 0x20], str.vxymlai_htwwf_dhgwhkky_tra_ckzwqvyz_vvmkbire_gkslkaj_spvuwbdsz_axrtyj_fhhzkkthk_atd_qfiu
cmp dword [ebp - 0x1c], 0x35cd
jle 0x441d5f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and dword [ebp - 0x14], 0
jmp 0x441cf7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x48da
jge 0x441d4d
and dword [ebp - 0x18], 0
jmp 0x441d0d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x74f
jge 0x441d4b
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.004019bd
pop ecx
pop ecx
mov ecx, eax
call fcn.0040e020
push eax
call fcn.0049dd57
pop ecx
lea ecx, [ebp - 0x48]
call fcn.0040e016
jmp 0x441d06
jmp 0x441cf0
push 0
push 0x6bc
push 0x1930
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x30a7
jge 0x441d7b
push dword [ebp - 0x20]
call fcn.0049dd57
pop ecx
jmp 0x441d97
or dword [ebp - 4], 0xffffffff
jmp 0x441da1
push 1
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
call fcn.00441de3
add esp, 0xc
jmp 0x441dd2
push 1
push 0
push 0x263b
push 0xfc4
push 0x35e8
call fcn.00446b4a
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4428bf
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x44295b
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4428fd
push 1
call fcn.00442a0a
pop ecx
jmp 0x442956
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x442941
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x44293f
push 0x1ec0
push 0xa97
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x442956
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xd6273d59
jmp 0x442a06
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4429a1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x40]
push 1
push dword [ebp - 0x44]
call fcn.00436b0b
add esp, 0xc
jmp 0x442a06
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x4429ee
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x4429ec
push 0x2db3
push 0
push 0x40e0
push 0x13cb
push 1
push 1
push 1
call fcn.0044ac7f
add esp, 0x1c
jmp 0x442a06
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x442a06
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esp, ebp
pop ebp
ret
Function at 0x442d2e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3a5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x442ec8
lea eax, [ebp + 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x6280
mov dword [ebp - 0x28], str.mzvklgtdv_iwhlxt_afabsrbr_mcmnvah_zxfidodj_mmdn
cmp dword [ebp - 0x24], 0x64be
jle 0x442e43
and dword [ebp - 0x14], 0
jmp 0x442da8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2196
jge 0x442e3b
and dword [ebp - 0x18], 0
jmp 0x442dc2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1fe3
jge 0x442e36
and dword [ebp - 0x1c], 0
jmp 0x442dd8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xf4e
jge 0x442e34
and dword [ebp - 0x20], 0
jmp 0x442dee
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xdcf
jge 0x442e32
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.004019bd
pop ecx
pop ecx
mov ecx, eax
call fcn.0040e020
push eax
call fcn.0049dd57
pop ecx
lea ecx, [ebp - 0x78]
call fcn.0040e016
jmp 0x442de7
jmp 0x442dd1
jmp 0x442dbb
jmp 0x442da1
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x5f7b
jge 0x442e5f
push dword [ebp - 0x28]
call fcn.0049dd57
pop ecx
jmp 0x442e7b
or dword [ebp - 4], 0xffffffff
jmp 0x442e85
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x35ac
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
push eax
push 0x2b00
mov eax, dword [ebp - 0x3c]
push dword [eax]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 1
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.00442f0f
add esp, 0x30
jmp 0x442efe
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0
push dword [ebp - 0x58]
push 0x702f
push 0x2ea8
push 0x74d1
push 1
call fcn.00427bee
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4486d3
Capabilities:
Query environment variable
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x448751
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x44872b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x63e5
push 0x36b8
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004487ea
add esp, 0x14
jmp 0x44874c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push 1
push 0x5919
push 0
push dword [ebp - 0x1c]
push 0x2844
call fcn.00428cd7
add esp, 0x18
jmp 0x4487e6
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4487b7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4487a9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x4487a7
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4487b5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4487e6
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push 1
push dword [ebp - 0x40]
push 1
push 1
push 0x5422
push 1
push 0x26f1
push 0x7c9d
push 0x68b6
push 0
call fcn.00441072
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x454e78
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x454f01
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x454ece
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x454ebc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x454ecc
push 0x1ec0
push 0xa97
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x454eff
push 0x60f4
push 0x1b72
push 0x1c5a
push 0x7115
push 0x2c83
push 0x7fdd
push 0
push 1
push 0x85a
push 1
call fcn.00428dc4
add esp, 0x28
jmp 0x454f41
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
push eax
push 0x182e
push 1
push dword [ebp - 0x20]
call fcn.0042258b
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x455221
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x455306
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4552ca
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4552a6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4552a4
push 0
push 0x597
push 0x24e2
push 0x7dd
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x4552c8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4552c8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x455304
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 1
push 0x4d6b
push 0x54db
push 0x1935
push 0x4029
push 0x3999
push 0x7915
push 0
push dword [ebp - 0x34]
push 0x7f10
push 1
call fcn.0044a95f
add esp, 0x2c
jmp 0x45537f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x455367
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x455344
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x455365
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x455365
push 0x1dd2
call dword [sym.imp.USER32.dll_ShowCaret]
jmp 0x45537f
push 0x5f20
push 0x6ab7
push 0
push 1
push 0
call fcn.0044d782
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x455ac6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x455aef
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 1
call fcn.00455be9
pop ecx
pop ecx
jmp 0x455be5
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x455b91
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x455b52
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x455b8f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x455b8f
push 0x71d8
push 0x440f
push 0
push 0x51bb
push 0
push 0
push 0x52e
push 0x1ca3
call fcn.00448e15
add esp, 0x20
jmp 0x455be5
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x455bb6
push 0x1220
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x455be5
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x455be5
push 0
push 0
push 0x2593
push 0x18b3
push 0x15e3
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov esp, ebp
pop ebp
ret
Function at 0x465654
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3dd9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x465789
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x4784
mov dword [ebp - 0x38], str.txnvey_afiwxcwc_ioncagpex_hyuoezi_usz
cmp dword [ebp - 0x1c], 0x4ac2
jle 0x465713
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and dword [ebp - 0x14], 0
jmp 0x4656d2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3073
jge 0x465713
and dword [ebp - 0x18], 0
jmp 0x4656e8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x411b
jge 0x465711
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0xa97fd8
call fcn.0040e02b
jmp 0x4656e1
jmp 0x4656cb
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
push 0x12e0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0x1234
push dword [ebp - 0x30]
push 0x6bb7
push dword [ebp - 0x34]
push 0x28a4
push 0
call fcn.00467fa6
add esp, 0x2c
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x46f7
jge 0x465761
mov edx, dword [ebp - 0x38]
mov ecx, 0xa97fd8
call fcn.0041000e
jmp 0x46577d
or dword [ebp - 4], 0xffffffff
jmp 0x465787
jmp 0x4657c1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x3c], eax
push 0x60df
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 1
push 0x4d53
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.004651d3
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46adc2
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3e79
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x46af8a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x46af6c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0x5a7f
mov dword [ebp - 0x54], str.ioamgnjzd_fjbpvzdvx_ojccwjltn_qub
cmp dword [ebp - 0x28], 0x5c64
jle 0x46aeb3
and dword [ebp - 0x18], 0
jmp 0x46ae58
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2128
jge 0x46aeb3
and dword [ebp - 0x1c], 0
jmp 0x46ae6e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x21f7
jge 0x46aeb1
and dword [ebp - 0x20], 0
jmp 0x46ae84
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6583
jge 0x46aeaf
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
mov ecx, 0xa97fd8
call fcn.0040e02b
jmp 0x46ae7d
jmp 0x46ae67
jmp 0x46ae51
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x46aee4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x46aee2
push 0
push 0x6e1
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x46af2a
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
jmp 0x46af06
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
jg 0x46af2a
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x46af28
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x46aefb
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x58c4
jge 0x46af44
mov edx, dword [ebp - 0x54]
mov ecx, 0xa97fd8
call fcn.0041000e
jmp 0x46af60
or dword [ebp - 4], 0xffffffff
jmp 0x46af6a
jmp 0x46af88
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push 0
call fcn.0046c460
add esp, 0xc
jmp 0x46af95
push 1
push 0
call fcn.0046f0d4
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470051
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4700a0
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push 0
push 0x57f8
push 0x4b59
push 1
push 0x57b4
push 0x7de5
push 0x663c
push 0x7302
push 0x2f1
call fcn.00480739
add esp, 0x28
jmp 0x470183
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x47013e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x47011c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x47011a
push 0x1ff3
push 0x1c72
push 0x21e6
push 0x438
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x47013c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x47013c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x470183
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
push 1
push 0x2ea1
push 0x7a63
push 1
push 1
push 0x57c1
push 0x67a4
push 0
push 0x3832
push 0x6af0
push dword [ebp - 0x3c]
push 0x1214
push dword [ebp - 0x40]
call fcn.00469c0a
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x481375
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4813e2
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4813a9
push 1
push 0x2934
call fcn.00481402
pop ecx
pop ecx
jmp 0x4813e0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4813c7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4813e0
push 0
push 0
push 0x2593
push 0x18b3
push 0x15e3
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x4813fe
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
call fcn.0046bdd0
add esp, 0xc
mov esp, ebp
pop ebp
ret