joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b3618
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.00424e80
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.0044f43d
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f60
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060da
push dword [esp + 0x18]
call fcn.0044f438
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0057732c
mov esp, ebp
pop ebp
ret 4

Function at 0x4071b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b37e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.005997f5
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40bba0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b3f9b
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00465369
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00469c89
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x40bca3
call fcn.004662e6
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40bc22
push 0x80004005
call fcn.0040cef0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push 0x65
mov dword [esp + 0x1c4], 0
call fcn.004695a4
test eax, eax
je 0x40bc56
push 0x65
push eax
lea ecx, [esp + 0x20]
call fcn.0040c880
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x40bc7e
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [esp + 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [esp + 0x1c0], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bca3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xbc]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, ebx
call fcn.0040ba60
mov eax, 1
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.0057732c
mov esp, ebp
pop ebp
ret

Function at 0x40c510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00464be8

Function at 0x40c750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c765
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c7a4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c7a0
lea ebx, [ebx]
cmp esi, edx
jae 0x40c7a4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c790
cmp esi, edx
jb 0x40c7a9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b445b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea edx, [edi + 0x30]
mov byte [edi + 0x1c], 0
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp + 8], 0x2c
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, word [esi + 6]
mov word [edi + 6], ax
movzx eax, word [esi + 8]
mov word [edi + 8], ax
movzx eax, word [esi + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esi + 0xc]
mov word [edi + 0xc], ax
movzx eax, word [esi + 0xe]
mov word [edi + 0xe], ax
movzx eax, word [esi + 0x10]
mov word [edi + 0x10], ax
movzx eax, word [esi + 0x12]
mov word [edi + 0x12], ax
movzx eax, word [esi + 0x14]
mov word [edi + 0x14], ax
movzx eax, word [esi + 0x16]
mov word [edi + 0x16], ax
movzx eax, word [esi + 0x18]
mov word [edi + 0x18], ax
movzx eax, word [esi + 0x1a]
mov word [edi + 0x1a], ax
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov eax, dword [esi + 0x1d]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x21]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x2a], al
mov eax, dword [esi + 0x28]
push eax
mov dword [edi + 0x2c], eax
lea eax, [ebp + 8]
push edx
push eax
call fcn.004082b0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ecx + esi]
mov dword [edi + 0x48], eax
movzx eax, word [ecx + esi + 4]
mov word [edi + 0x4c], ax
movzx eax, byte [ecx + esi + 6]
mov byte [edi + 0x4e], al
mov eax, dword [ecx + esi + 7]
mov dword [edi + 0x50], eax
mov eax, dword [ecx + esi + 0xb]
mov dword [edi + 0x54], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418f30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b5198
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0xc], 0
call fcn.00443f50
push 0x604194
lea edx, [esp + 0x44]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x2c]
call fcn.00409970
add esp, 4
mov byte [esp + 0x68], 1
lea edx, [esp + 0x28]
cmp dword [esp + 0x3c], 0x10
lea ecx, [esp + 0x10]
cmovae edx, dword [esp + 0x28]
call fcn.00430550
mov byte [esp + 0x68], 2
lea ecx, [esp + 0x10]
cmp dword [esp + 0x24], 0x10
mov edx, 0x603967
push 0
cmovae ecx, dword [esp + 0x14]
call fcn.00405ec0
add esp, 4
test eax, eax
jne 0x418ffd
cmp dword [esp + 0x20], eax
setne al
test eax, eax
jne 0x418ffd
push eax
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], eax
push 0x603975
mov byte [esi], al
call fcn.00404be0
jmp 0x419035
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419029
test al, 0x10
je 0x419029
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004044d0
jmp 0x419035
push 0x603976
mov ecx, esi
call fcn.00404470
cmp dword [esp + 0x24], 0x10
jb 0x419048
push dword [esp + 0x10]
call fcn.0044f438
add esp, 4
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x419070
push dword [esp + 0x28]
call fcn.0044f438
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jb 0x419098
push dword [esp + 0x40]
call fcn.0044f438
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0057732c
mov esp, ebp
pop ebp
ret
Function at 0x41a970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b54d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00444ac0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
test eax, 0xfffffffc
jne 0x41aa00
test ecx, ecx
je 0x41a9e7
push ecx
call fcn.0044f438
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057732c
mov esp, ebp
pop ebp
ret
cmp dword [0x6316dc], 1
jne 0x41aa0e
call fcn.0041a0d0
cmp dword [0x6402e0], 0
je 0x41aa1c
call fcn.004189c0
push 0
call fcn.005789a2
int3
Function at 0x41d550
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b59f9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x603a79
mov dword [ebp - 0x1c], esi
mov byte [esi], 0
call fcn.00404be0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x14], 2
jl 0x41d621
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.004255b0
mov edi, eax
cmp esi, edi
je 0x41d610
cmp dword [esi + 0x14], 0x10
jb 0x41d5f7
push dword [esi]
call fcn.0044f438
add esp, 4
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.004045a0
cmp dword [ebp - 0x20], 0x10
jb 0x41d621
push dword [ebp - 0x34]
call fcn.0044f438
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057732c
mov esp, ebp
pop ebp
ret
Function at 0x41fd40
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x130]
sub eax, dword [ecx + 0x134]
cmp eax, 0x28
jge 0x41fd66
cmp byte [ecx + 0x61], 0
jne 0x41fd66
cmp byte [ecx + 0x60], 0
je 0x41fd66
mov byte [ecx + 0x60], 0
jmp fcn.00449d10
ret
Function at 0x4245c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6092
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x154], 0
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x603b3a
mov dword [ebp - 0x158], esi
mov byte [esi], 0
call fcn.00404be0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x154], 1
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x18
push str.unknown_OperatingSystem.
mov ecx, esi
mov dword [ebp - 0x150], 0x11c
call fcn.00404be0
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x424786
mov eax, dword [ebp - 0x14c]
sub eax, 4
je 0x424741
dec eax
je 0x4246e4
dec eax
jne 0x424786
mov eax, dword [ebp - 0x148]
sub eax, 0
je 0x4246c8
dec eax
je 0x4246ac
dec eax
jne 0x424786
cmp byte [ebp - 0x36], 1
jne 0x424786
push str.Microsoft_Windows_10
jmp 0x42477f
cmp byte [ebp - 0x36], 1
mov ecx, esi
jne 0x4246be
push str.Microsoft_Windows_7
jmp 0x424781
push str.Microsoft_Windows_Server_2008_R2
jmp 0x424781
cmp byte [ebp - 0x36], 1
mov ecx, esi
jne 0x4246da
push str.Microsoft_Windows_Vista
jmp 0x424781
push str.Microsoft_Windows_Server_2008
jmp 0x424781
mov eax, dword [ebp - 0x148]
sub eax, 0
je 0x42473a
dec eax
je 0x424733
dec eax
jne 0x424786
cmp byte [ebp - 0x36], 1
jne 0x42470d
cmp word [ebp - 0x34], 9
jne 0x42470d
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x42477f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x424720
push str.Microsoft_Windows_Server_2003
jmp 0x42477f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424786
push str.Microsoft_Windows_Server_2003_R2
jmp 0x42477f
push str.Microsoft_Windows_XP
jmp 0x42477f
push str.Microsoft_Windows_2000
jmp 0x42477f
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x424763
cmp eax, 0xa
je 0x42475c
cmp eax, 0x5a
jne 0x424786
push str.Microsoft_Windows_Me
jmp 0x42477f
push str.Microsoft_Windows_98
jmp 0x42477f
mov eax, dword [ebp - 0x140]
cmp eax, 2
jne 0x424775
push str.Microsoft_Windows_NT_4.0
jmp 0x42477f
cmp eax, 1
jne 0x424786
push str.Microsoft_Windows_95
mov ecx, esi
call fcn.00405a10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057732c
mov esp, ebp
pop ebp
ret
Function at 0x424b20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
xor edi, edi
mov dword [ebp - 0x14], edx
cmp byte [ecx], 0
je 0x424c5d
push esi
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
push ebx
lea ecx, [ecx]
mov bl, byte [esi - 2]
xor al, al
mov dword [ebp - 8], 0xffffffff
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dl, byte [ebp - 8]
cmp byte [esi], bl
lea esi, [esi + 1]
movzx ecx, al
movzx edx, dl
cmove edx, ecx
inc al
cmp al, 0x40
jb 0x424b54
mov eax, dword [ebp - 4]
xor bl, bl
mov cl, byte [ebp - 7]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dword [ebp - 0x10], edx
mov bh, byte [eax - 1]
jmp 0x424b80
cmp byte [esi], bh
lea esi, [esi + 1]
movzx eax, bl
movzx ecx, cl
cmove ecx, eax
inc bl
cmp bl, 0x40
jb 0x424b80
mov eax, dword [ebp - 4]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov bl, byte [ebp - 6]
mov dword [ebp - 0xc], ecx
xor cl, cl
mov ch, byte [eax]
cmp byte [esi], ch
lea esi, [esi + 1]
movzx eax, cl
movzx ebx, bl
cmove ebx, eax
inc cl
cmp cl, 0x40
jb 0x424ba7
mov esi, dword [ebp - 4]
xor cl, cl
mov dl, byte [ebp - 5]
mov ch, byte [esi + 1]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea esp, [esp]
cmp byte [esi], ch
lea esi, [esi + 1]
movzx eax, cl
movzx edx, dl
cmove edx, eax
inc cl
cmp cl, 0x40
jb 0x424bd0
mov ecx, dword [ebp - 0xc]
mov al, cl
mov esi, dword [ebp - 4]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
shr al, 4
shl dl, 2
and al, 3
or al, dl
mov edx, dword [ebp - 0x14]
mov byte [edi + edx], al
cmp byte [esi], 0x3d
je 0x424c53
mov al, bl
shl cl, 4
shr al, 2
and al, 0xf
or al, cl
mov byte [edi + edx + 1], al
cmp byte [esi + 1], 0x3d
je 0x424c49
mov ecx, dword [ebp - 8]
add esi, 4
and cl, 0x3f
shl bl, 6
or cl, bl
mov dword [ebp - 4], esi
mov byte [edi + edx + 2], cl
add edi, 3
cmp byte [esi - 2], 0
jne 0x424b40
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
pop esi
lea eax, [edi + 2]
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
pop esi
lea eax, [edi + 1]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x429e00
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b65b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x6016f5
mov byte [esi], 0
call fcn.00404be0
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x6016f5
mov byte [ecx], 0
call fcn.00404be0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x40]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x6016f5
mov byte [ecx], 0
call fcn.00404be0
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x6016f5
mov byte [ecx], 0
call fcn.00404be0
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 3
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x6016f5
mov byte [ecx], 0
call fcn.00404be0
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x6016f5
mov byte [ecx], 0
call fcn.00404be0
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 5
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x6016f5
mov byte [ecx], 0
call fcn.00404be0
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 6
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x6016f5
mov byte [ecx], 0
call fcn.00404be0
mov word [esi + 0xd0], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42b520
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b674b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 0x234], 0
push eax
push 0x6049b8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x230]
call fcn.004255b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 0x10
mov edx, 0x603b8f
push 0
cmovae ecx, dword [ebp - 0x230]
call fcn.00405ec0
add esp, 4
test eax, eax
jne 0x42b5c4
cmp dword [ebp - 0x220], eax
setne al
test eax, eax
jne 0x42b5c4
push 1
push 0x6049c8
jmp 0x42b5ef
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42b5e8
test al, 0x10
jne 0x42b5fa
push 1
push 0x6049cc
lea ecx, [ebp - 0x230]
call fcn.00404be0
push 1
push 0
push esi
lea ecx, [ebp - 0x230]
call fcn.004259b0
cmp dword [ebp - 0x21c], 0x10
jb 0x42b621
push dword [ebp - 0x230]
call fcn.0044f438
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057732c
mov esp, ebp
pop ebp
ret
Function at 0x42be70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b68e0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push esi
mov byte [edi], 0
call fcn.004047b0
push 0xffffffffffffffff
lea ecx, [edi + 0x18]
mov dword [ebp - 4], 0
push 0
lea eax, [esi + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x40]
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
lea eax, [esi + 0x40]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
push 0xffffffffffffffff
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 2
push 0
lea eax, [esi + 0x58]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
push 0xffffffffffffffff
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 3
push 0
lea eax, [esi + 0x70]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
push 0xffffffffffffffff
lea ecx, [edi + 0x88]
mov byte [ebp - 4], 4
push 0
lea eax, [esi + 0x88]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
lea ecx, [edi + 0xa0]
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push 0
lea eax, [esi + 0xa0]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
push eax
call fcn.004047b0
push 0xffffffffffffffff
lea ecx, [edi + 0xb8]
mov byte [ebp - 4], 6
push 0
lea eax, [esi + 0xb8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
movzx eax, byte [esi + 0xd0]
mov byte [edi + 0xd0], al
movzx eax, byte [esi + 0xd1]
mov byte [edi + 0xd1], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4