joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419640
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x519c04
call fcn.00497f70
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.004250e5
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.00425119
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x419680
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4196e2
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x5207b0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4196bd
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4196e2
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.004250f8
call fcn.00497f4a
ret 8

Function at 0x41980e
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x519c2a
call fcn.00497fa4
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x84]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x419839
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x419917
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x5207d8
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00407fd0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.004c9210
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x521b6c
push eax
call fcn.00409c80
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 1], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x4198cc
call fcn.0041972a
jmp 0x4198d1
call fcn.004197e4
push eax
lea ecx, [ebp - 0x828]
call fcn.0040b170
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.0040c620
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.004d01f4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.0040c620
mov eax, esi
call fcn.00497f5f
ret 0xc
Function at 0x419921
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x519c74
call fcn.00497fa4
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.004c9210
lea eax, [edi + 0x84]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41997e
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00409cb0
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x4199c4
mov eax, dword [esi]
jmp 0x4199c6
mov eax, esi
push ebx
push eax
call fcn.004d0a7c
pop ecx
pop ecx
test eax, eax
jne 0x419a12
cmp byte [edi + 1], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x4199f6
call fcn.0041972a
jmp 0x4199fb
call fcn.004197e4
push eax
mov ecx, esi
call fcn.0040b170
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0040c620
mov eax, esi
call fcn.00497f5f
ret 0x10
Function at 0x41ac6c
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x519d11
call fcn.00497fa4
mov ebx, ecx
call fcn.004196f2
lea edi, [ebx + 0xcc]
push eax
mov ecx, edi
call fcn.0041b0e5
mov esi, str.SwiftImage.ini
push esi
call fcn.004d0956
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0040a6a0
push 0x5245a0
push 0x5245a8
push str.MainAppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.004197ba
and dword [ebp - 4], 0
lea esi, [ebx + 0xe4]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x41ace2
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00407eb0
push 0x5245a0
mov ecx, esi
call fcn.0041b13c
test eax, eax
jne 0x41ad5e
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004c9210
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41ad0f
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, 0x5245a0
push eax
push edi
push 0x5245a8
push str.MainAppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x41ad40
xor eax, eax
jmp 0x41ad4d
lea eax, [ebp - 0x218]
push eax
call fcn.004d0956
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407fd0
jmp 0x41ad63
mov edi, 0x5245a0
push edi
mov ecx, esi
call fcn.0041b13c
test eax, eax
jne 0x41ae26
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004c9210
add esp, 0xc
lea eax, [ebx + 0x54]
lea ecx, [ebp - 0x230]
push eax
call fcn.004189b5
push str.SwiftImage.ini
mov byte [ebp - 4], 1
call fcn.004d0956
pop ecx
push eax
push str.SwiftImage.ini
lea ecx, [ebp - 0x230]
call fcn.0040a6a0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x5245a8
push str.MainAppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x41adf7
xor eax, eax
jmp 0x41ae04
lea eax, [ebp - 0x218]
push eax
call fcn.004d0956
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407fd0
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.0040c620
push edi
mov ecx, esi
call fcn.0041b13c
test eax, eax
jne 0x41ae62
push edi
push 0x5245a8
push str.MainAppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.00419921
push eax
mov ecx, esi
call fcn.0040b170
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0040c620
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0040c620
call fcn.00497f5f
ret
Function at 0x42191c
Capabilities:
Check os version

Disassembly:
push 0x34c
mov eax, 0x51a73d
call fcn.00497fa4
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x330]
xor ebx, ebx
mov dword [ebp - 0x358], esi
push 0x118
push ebx
mov dword [ebp - 0x350], ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x334], 0x11c
call fcn.004c9210
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x5207d8
mov ecx, esi
call fcn.00409cb0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x34c], eax
movzx eax, byte [ebp - 0x21a]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x32c]
push 0x524c80
mov dword [ebp - 4], ebx
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x348], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x421a13
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421a0c
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x340]
push ecx
call eax
movzx eax, word [ebp - 0x33c]
mov dword [ebp - 0x33c], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x34c]
cmp eax, 5
jne 0x421a45
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x421b11
cmp eax, 1
jne 0x421a3b
mov edi, str.WindowsXP
jmp 0x421b01
mov edi, str.WindowsServer2003
jmp 0x421b01
cmp eax, 6
jne 0x421b11
mov eax, dword [ebp - 0x348]
sub eax, ebx
je 0x421aee
sub eax, 1
je 0x421ae7
mov edi, dword [ebp - 0x338]
sub eax, 1
jne 0x421b17
cmp edi, 0x1ebb
jne 0x421a83
mov edi, str.Windows8
jmp 0x421b01
lea eax, [edi - 0x1ee6]
cmp eax, 0x25
jbe 0x421a7c
cmp edi, 0x1f13
je 0x421a7c
cmp dword [ebp - 0x340], 0xa
jne 0x421abb
cmp dword [ebp - 0x344], 0
jne 0x421b17
push str.Windows10
call fcn.004d0956
pop ecx
push eax
push str.Windows10
jmp 0x421ade
cmp dword [ebp - 0x340], 6
jne 0x421b17
cmp dword [ebp - 0x344], 3
jne 0x421b17
push str.Windows8.1
call fcn.004d0956
pop ecx
push eax
push str.Windows8.1
mov ecx, esi
call fcn.00407fd0
jmp 0x421b17
mov edi, str.Windows7
jmp 0x421b01
cmp dword [ebp - 0x354], 1
mov edi, str.WindowsVista
je 0x421b01
mov edi, str.WindowsServer2008
push edi
call fcn.004d0956
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00407fd0
mov edi, dword [ebp - 0x338]
push 0x5207d8
mov ecx, esi
call fcn.0041b13c
test eax, eax
jne 0x421b85
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004c9210
mov eax, dword [ebp - 0x34c]
push edi
push dword [ebp - 0x348]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.00409c80
add esp, 0x20
cmp word [ebp - 0x218], 0
jne 0x421b69
mov eax, ebx
jmp 0x421b76
lea eax, [ebp - 0x218]
push eax
call fcn.004d0956
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407fd0
cmp dword [ebp + 0xc], 0
je 0x421bb3
cmp word [ebp - 0x320], 0
je 0x421ba4
lea eax, [ebp - 0x320]
push eax
call fcn.004d0956
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x320]
mov ecx, esi
push eax
call fcn.0040a6a0
mov eax, esi
call fcn.00497f5f
ret
Function at 0x421ce9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push str.51c285e801f71dc33e88b85e170ad1b2
mov dword [ebp - 4], esi
call fcn.004d09c0
mov edi, dword [ebp + 0xc]
mov edx, eax
mov ebx, dword [ebp + 8]
pop ecx
mov ecx, esi
test edi, edi
je 0x421d24
mov al, byte [esi + str.51c285e801f71dc33e88b85e170ad1b2]
xor byte [ecx + ebx], al
inc esi
xor eax, eax
cmp esi, edx
cmovge esi, eax
inc ecx
cmp ecx, edi
jb 0x421d0e
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.00401090
test eax, eax
je 0x421d46
mov edx, dword [ebp - 4]
test edx, edx
je 0x421d46
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x421d50
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421ff0
Capabilities:
Create directory

Disassembly:
push 0x49c
mov eax, 0x51a7ab
call fcn.00497fa4
mov ebx, ecx
mov edi, dword [ebp + 8]
test edi, edi
jne 0x42200f
xor eax, eax
jmp 0x422197
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004c9210
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.004d0af0
push edi
xor esi, esi
call fcn.004d09c0
mov edi, eax
mov dword [ebp - 0x214], 7
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x218], ecx
mov word [ebp - 0x228], ax
push 0x100
push ecx
lea eax, [ebp - 0x210]
mov dword [ebp - 4], ecx
push eax
call fcn.004c9210
add esp, 0x24
cmp byte [ebp + edi - 0x111], 0x5c
je 0x42207e
mov byte [ebp + edi - 0x110], 0x5c
cmp byte [ebp - 0x110], 0
je 0x422185
mov al, byte [ebp + esi - 0x110]
cmp al, 0x3a
jne 0x42209e
push 2
pop eax
jmp 0x422175
cmp al, 0x5c
jne 0x422172
push esi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004c8c90
add esp, 0xc
cmp esi, 0x100
jae 0x4221b3
lea eax, [ebp - 0x210]
mov byte [ebp + esi - 0x210], 0
push eax
lea ecx, [ebp - 0x240]
call fcn.00411090
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x258]
mov ecx, ebx
push eax
call fcn.00422706
push eax
lea ecx, [ebp - 0x228]
call fcn.0040b170
push 0
push 1
lea ecx, [ebp - 0x258]
call fcn.0040c620
push 0
push 1
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.00418869
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x422172
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
push 0
cmovae eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42219f
xor eax, eax
inc eax
add esi, eax
cmp byte [ebp + esi - 0x110], 0
jne 0x42208b
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.0040c620
xor eax, eax
inc eax
call fcn.00497f5f
ret 4
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.0040c620
jmp 0x422008
call fcn.00497c35
int3
Function at 0x4226d8
Capabilities:
Create thread

Disassembly:
mov edx, dword [ecx + 0x300]
or eax, 0xffffffff
cmp edx, eax
je 0x4226ea
cmp edx, 1
jne 0x422705
xor eax, eax
push eax
push eax
push ecx
push 0x422476
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret
Function at 0x422ac5
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xc8
mov eax, 0x51a89e
call fcn.00497fa4
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xd0], ebx
push ebx
xor eax, eax
mov dword [ebp - 4], ebx
push 0x5207d8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00407fd0
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.0042b5d3
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x422c39
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push ebx
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x422b63
push 0x5207d8
mov ecx, esi
call fcn.00409cb0
jmp 0x422c44
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc8], eax
inc eax
push eax
mov dword [ebp - 0xcc], eax
call fcn.004974ed
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x422ba2
push 0x5207d8
mov ecx, esi
call fcn.00409cb0
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0040c620
push ebx
jmp 0x422c50
push dword [ebp - 0xcc]
push 0
push ebx
call fcn.004c9210
add esp, 0xc
lea eax, [ebp - 0xd4]
push 0
push eax
push dword [ebp - 0xc8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xc4]
push ebx
call fcn.0042c020
push ebx
call fcn.0045ac20
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xc4]
call fcn.0042b86e
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.004210a7
pop ecx
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00418869
cmp dword [ebp - 0x30], ebx
jbe 0x422c2e
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407eb0
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0040c620
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00420676
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0040c620
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.0040c620
mov eax, esi
call fcn.00497f5f
ret
Function at 0x422c62
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x55d3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x61c]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0x620], ebx
call fcn.004c9210
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004c9210
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004d0abc
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004d0abc
lea eax, [ebp - 0x61c]
push eax
call fcn.004d0492
lea eax, [ebp - 0x414]
push eax
call fcn.004d0492
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004d0a7c
add esp, 0x38
test eax, eax
je 0x422db6
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x422db6
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor esi, esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c9210
add esp, 0xc
lea eax, [ebp - 0x20c]
test esi, esi
jne 0x422d3f
push edi
push str._s.bak
push eax
call fcn.00409c80
add esp, 0xc
jmp 0x422d4f
push esi
push edi
push str._s.bak_d
push eax
call fcn.00409c80
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x422d6d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.004cf4ed
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
test eax, eax
lea eax, [ebp - 0x20c]
push 0
push eax
jne 0x422db4
call ebx
cmp esi, 0xa
jge 0x422db6
inc esi
jmp 0x422d0e
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004974f6
mov esp, ebp
pop ebp
ret
Function at 0x4231f9
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x51a976
call fcn.00497fa4
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.004c9210
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.004c9210
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x4232d7
cmp word [edi], dx
jne 0x423268
mov eax, edx
jmp 0x42326f
push edi
call fcn.004d0956
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00407fd0
cmp dword [ebp - 0x30], 0
je 0x4232d7
mov edi, 0x520ff8
push edi
call fcn.004d0956
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00407fd0
xor edi, edi
cmp word [esi], di
jne 0x4232a0
mov eax, edi
jmp 0x4232a7
push esi
call fcn.004d0956
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040a6a0
mov esi, 0x520ffc
push esi
call fcn.004d0956
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040a6a0
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a590
jmp 0x4232f3
xor edi, edi
cmp word [esi], di
jne 0x4232e2
mov eax, edi
jmp 0x4232e9
push esi
call fcn.004d0956
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407fd0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x524e80
call fcn.00414330
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push 1
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x423338
mov esi, edi
jmp 0x423363
cmp byte [ebp + 0x10], 0
je 0x423350
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.0040c620
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0040c620
mov eax, esi
call fcn.00497f5f
ret
Function at 0x4233a5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x55d3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
push 0x44
xor ebx, ebx
push ebx
push eax
call fcn.004c9210
push 0x10
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x82c], 0x44
push ebx
push eax
call fcn.004c9210
push esi
lea eax, [ebp - 0x7d4]
push 0x520e68
push eax
call fcn.00409c80
add esp, 0x24
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42345a
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x7e8]
push eax
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004974f6
mov esp, ebp
pop ebp
ret

Function at 0x4235a6
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x51a9f2
call fcn.00497fa4
mov eax, dword [ebp + 8]
test eax, eax
je 0x4236a2
push eax
lea ecx, [ebp - 0x40]
call fcn.00409cb0
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0042115d
mov edi, 0x22c
lea eax, [ebp - 0x26c]
push edi
push ebx
push eax
call fcn.004c9210
add esp, 0x10
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x423693
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x423688
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x423632
mov eax, ebx
jmp 0x42363f
lea eax, [ebp - 0x248]
push eax
call fcn.004d0956
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407fd0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0042115d
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041b10c
test eax, eax
je 0x4236a8
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040c620
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x423615
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0040c620
mov eax, esi
call fcn.00497f5f
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.0040c620
jmp 0x423695