joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41da30
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4568fd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46d700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov edi, dword [0x46f080]
push 0xffffffffffffffff
call fcn.0041d730
push 0
push dword [0x46f09c]
mov ecx, 0x46f084
call fcn.00401eb0
push 0x41cca0
push 0
push dword [0x46f0a4]
mov ecx, 0x46f084
push 0x45aa64
call fcn.004027a0
mov ecx, dword [esi]
test edi, edi
js 0x41db73
cmp edi, dword [ecx + 0x3c]
jge 0x41db73
imul ebx, edi, 0xb8
push edi
add ebx, dword [ecx + 0x38]
call fcn.004046c0
test al, al
je 0x41db4a
mov eax, dword [esi]
cmp dword [eax + 0x18], 0
je 0x41db20
push 0
push dword [esi + 4]
call fcn.0042e8da
mov dword [ebp + 8], eax
test eax, eax
je 0x41db20
push str.D:_apreltechSibSiblSibJsInstall.cpp
lea ecx, [ebp - 0x10]
call fcn.00401580
push 0x42
push dword [eax]
mov dword [ebp - 4], 0
push dword [ebp + 8]
call fcn.0041b870
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41db20
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push dword [esi + 4]
call fcn.0042e9b3
test eax, eax
je 0x41db3b
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x41db4a
push 0
push dword [esi + 4]
push 3
call fcn.0041b870
add esp, 0xc
push edi
push ebx
mov ecx, esi
call fcn.0041d510
push dword [0x46f09c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0041ed52
int3
Function at 0x41dff0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4569b5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x46d700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 1
mov dword [0x46f070], 0
call fcn.0041dc80
mov esi, eax
mov byte [ebp - 4], 2
call fcn.0041f262
mov ecx, eax
mov byte [ebp - 4], 1
test ecx, ecx
je 0x41e1e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004017d0
test al, al
jne 0x41e08a
test esi, esi
jne 0x41e06c
xor ecx, ecx
jmp 0x41e080
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e071
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.00408b60
mov eax, dword [ebp - 0x10]
mov edx, 0x45ab3c
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x41e0ba
test si, si
je 0x41e0b6
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x41e0ba
add ecx, 4
add edx, 4
test si, si
jne 0x41e094
xor edx, edx
jmp 0x41e0bf
sbb edx, edx
or edx, 1
xor ecx, ecx
mov byte [ebp - 4], 1
test edx, edx
lea edx, [eax - 0x10]
sete cl
or edi, 0xffffffff
mov dword [0x46f06c], ecx
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e0ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp + 8]
push str.TRUE
push eax
call fcn.00409460
add esp, 8
test al, al
je 0x41e109
mov dword [0x46f074], 1
call fcn.0041e1f0
test al, al
je 0x41e1a0
push 0
push 0
push 0x41cd60
call fcn.004407c0
add esp, 0xc
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x46f100], 0
je 0x41e1a0
cmp dword [0x46f078], 0
je 0x41e1a0
push 0x96
lea eax, [ebp - 0x10]
mov ecx, 0x46f094
push eax
call fcn.00407700
push dword [eax]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.004031b0
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e186
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e1a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e1ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41e1d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004017b0
int3
Function at 0x420742
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x42076c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x420772
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.004044c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0042a9ac
int3

Function at 0x420a4d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x420a5e
xor eax, eax
jmp 0x420a7a
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420a7f
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.004044c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0042a9ac
int3

Function at 0x420b1d
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x4584b8]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x420b50
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.004044c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0042a9ac
int3

Function at 0x420c29
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x420c54
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x420c5a
cmp dword [ebp - 4], esi
jne 0x420c71
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.004044c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0042a9ac
lea ecx, [edi + 0xc]
call fcn.004044c0
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0042a602
int3
Function at 0x428f6b
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
inc eax
push edi
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 4], eax
lea ebx, [ecx + 0xc]
cmp dword [ecx + 8], edi
jle 0x428fe7
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x428fac
mov eax, dword [edx + 0x10]
cmp dword [eax + edi*8 + 4], esi
je 0x428fac
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x428fda
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x428fdd
mov eax, dword [ebx]
mov eax, dword [eax + edi*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x428fd4
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x4584b8]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx]
and dword [eax + edi*4], 0
mov eax, dword [ebp - 4]
inc edi
cmp edi, dword [ecx + 8]
jl 0x428f90
test eax, eax
je 0x42902e
lea esi, [edx + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add ecx, 0x14
push edi
call fcn.00429245
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x4584b8]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x429297
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x4570b9
call fcn.0042d958
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x42938e
cmp edi, dword [ebx + 0xc]
jge 0x42938e
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4292ee
cmp edi, dword [esi + 8]
jl 0x42937c
cmp dword [ebp + 0xc], 0
je 0x42937c
xor edi, edi
jmp 0x429320
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.00428d4f
mov esi, eax
test esi, esi
je 0x429308
mov dword [esi], vtable.CThreadData.0
jmp 0x42930a
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.0041f1ec
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x42933c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x429348
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x4293b5
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.00432080
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x42938e
cmp edi, dword [esi + 8]
jge 0x42938e
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0042d8bd
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041ed6c
int3
Function at 0x42ad3c
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x46d700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x230
xor edi, edi
push edi
push esi
call fcn.00432080
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.004409b6
push eax
call fcn.004046f0
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x45c154]
je 0x42ae9a
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x42aeae
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x42aeae
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
je 0x42adf8
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x42adec
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.0042ab43
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
jmp 0x42adf3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42adfa
mov eax, edi
mov ecx, esi
mov dword [ecx + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0042aeb2
test eax, eax
je 0x42ae21
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042a9ca
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x42ae25
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.0042aeb2
test eax, eax
je 0x42ae4c
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042a9ca
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x42ae50
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.0042aeb2
test eax, eax
je 0x42ae78
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042a9ca
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x42ae7a
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x42ae8c
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x42ae9a
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d32f
leave
ret 4
xor eax, eax
jmp 0x42ae9d

Function at 0x42e0aa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42e0e9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42e0e9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42e0e9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42e0e9
cmp dword [ecx + 0x74], 0xe
jbe 0x42e0e9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42e8da
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42e9ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42e90a
xor esi, esi
jmp 0x42e9ab
cmp eax, 3
je 0x42e91b
push 0
push edi
call fcn.0042e9b3
test eax, eax
jne 0x42e903
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x42e998
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x42e934
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x42e92d
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x42e998
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.0042e8da
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x42e9aa
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42e994
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x42e985
xor esi, esi
inc esi
jmp 0x42e9aa
test esi, esi
jle 0x42e9aa
movzx esi, si
or esi, 0x80070000
jmp 0x42e9aa
xor esi, esi
jmp 0x42e9aa
mov esi, 0x80070003
push esi
push 0x72
push str.c:_agent_work66_s_srclibsdutildirutil.cpp
call fcn.0042e9de
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x42e9b3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42e9d7
test al, 0x10
je 0x42e9d7
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42e9d4
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x430d99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x430dba
jl 0x430db1
test edi, edi
jne 0x430dba
xor eax, eax
xor edx, edx
jmp 0x430e7b
cmp dword [ebx + 0x38], 0
je 0x430dcf
push eax
push edi
push dword [ebp + 8]
call fcn.00430e81
jmp 0x430e7b
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x430e16
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x430e16
cmp eax, edi
jb 0x430df0
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00431b00
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x430e1c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x430e70
mov ecx, ebx
call fcn.00430559
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x430e5b
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00444e93
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x430e70
jmp 0x430e2e
test edx, edx
je 0x430e70
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00444e93
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x430f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x430f92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00431055
jmp 0x431050
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x430fb8
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x430fbd
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x43101d
jg 0x430fd2
test esi, esi
je 0x43101d
test ecx, ecx
jl 0x431018
jg 0x430fdc
test eax, eax
je 0x431018
cmp edi, ecx
jg 0x430fee
jl 0x430fe6
cmp esi, eax
jae 0x430fee
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00431b00
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x431020
mov ecx, dword [ebp + 8]
jmp 0x43102a
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x431044
jg 0x43102a
test esi, esi
je 0x431044
cmp dword [ebx + 0x4c], 0
je 0x431044
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004405b9
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44e78f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044e605

Function at 0x4543f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45441d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45441d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x42e2b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42e361
push 0x208
call main
add esp, 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x42e361
mov edx, dword [ebp - 0x14]
push edx
call fcn.00414d9d
add esp, 4
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call main
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42e373
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x14]
call main
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00414d9d
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x432550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a919
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x44ec90]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
push 0x11c
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.004148c0
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4325d2
mov dword [ebp - 0x13c], 0x114
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4325e8
cmp dword [ebp - 0x138], 6
jb 0x4325e8
mov dword [ebp - 0x14], 1
movzx eax, byte [0x452c91]
test eax, eax
jne 0x43267e
cmp dword [ebp - 0x14], 0
je 0x43263b
push str.Vista_or_later
lea ecx, [ebp - 0x140]
call main
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x140]
push ecx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call main
jmp 0x432677
push str.not_Vista_or_later
lea ecx, [ebp - 0x144]
call main
mov dword [ebp - 4], 1
push 0
lea edx, [ebp - 0x144]
push edx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call main
mov byte [0x452c91], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00414838
mov esp, ebp
pop ebp
ret
Function at 0x348c06d1
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x348c082f
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x348c082f
mov esi, dword [ebp]
test esi, esi
je 0x348c082f
push ebx
mov ebx, dword [esp + 0x20]
cmp ebx, 1
jne 0x348c0712
cmp esi, 2
jae 0x348c0712
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 0x18
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebp
push edi
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
mov dword [esp + 0x24], eax
jne 0x348c0824
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x348c075f
cmp ebx, 1
jne 0x348c074c
cmp ecx, 2
je 0x348c0768
pop ebx
pop edi
mov dword [esp + 0x1c], 0x65d
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
ret 0x18
cmp ebx, 1
jne 0x348c0824
mov eax, dword [ebp]
cmp eax, esi
jae 0x348c077d
shr eax, 1
mov word [edi + eax*2], 0
mov ecx, dword [esp + 0x28]
jmp 0x348c0788
mov edx, esi
shr edx, 1
mov word [edi + edx*2 - 2], 0
cmp ecx, 2
jne 0x348c0824
push esi
call dword [sym.imp.msvcr80.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x348c07ad
pop ebx
pop edi
pop esi
mov eax, 0xe
pop ebp
ret 0x18
shr esi, 1
push esi
push ebx
push edi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
test eax, eax
jbe 0x348c0806
cmp esi, eax
lea ecx, [eax + eax]
mov dword [ebp], ecx
jae 0x348c07e8
push ebx
mov word [edi], 0
mov dword [esp + 0x28], 0xea
call dword [sym.imp.msvcr80.dll_free]
mov eax, dword [esp + 0x28]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
push esi
push edi
push ebx
call dword [sym.imp.MSO.dll_Ordinal_6877]
push ebx
call dword [sym.imp.msvcr80.dll_free]
mov eax, dword [esp + 0x28]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
mov word [edi], 0
push ebx
mov dword [ebp], 0
mov dword [esp + 0x28], 0x57
call dword [sym.imp.msvcr80.dll_free]
add esp, 4
mov eax, dword [esp + 0x24]
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 0x18