joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42675f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x1034
push 1
call fcn.00402908
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
pop ecx
pop ecx
xor edi, edi
push edi
push edi
mov esi, eax
mov eax, dword [ebp + 8]
push edi
push edi
mov dword [esi], edi
mov dword [esi + 4], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [0x44bbb8]
cmp eax, edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
jne 0x4267cf
push 0x40ae3f
call fcn.004250db
pop ecx
mov dword [0x44bbb8], eax
push esi
push eax
call fcn.0042564f
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [esi + 4]
push eax
push 0x4264c9
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 0x1c], 1
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4267fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0x1034
inc edi
push edi
call fcn.00402908
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
pop ecx
mov esi, eax
mov eax, dword [ebp + 8]
pop ecx
mov dword [esi], edi
xor edi, edi
push edi
push edi
push edi
push edi
mov dword [esi + 4], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x38]
push eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.0040284f
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [0x44bbb8]
cmp eax, edi
pop ecx
jne 0x426878
push 0x40ae3f
call fcn.004250db
pop ecx
mov dword [0x44bbb8], eax
push esi
push eax
call fcn.0042564f
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [esi + 4]
push eax
push 0x426629
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42865f
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
push 0x107
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x10c]
push 0x4452ac
push eax
call fcn.0042be40
pop ecx
pop ecx
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4286d3
lea eax, [ebp - 0x24c]
push 0x140
push eax
call dword [ebp + 8]
pop ecx
pop ecx
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4286a9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call dword [ebp + 8]
push dword [ebp + 8]
call fcn.00429bc8
add esp, 0xc
call fcn.004284c5
pop esi
leave
ret
Function at 0x4288ed
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [ebp + 0x28]
cmp dword [eax + 0x428], 5
je 0x428903
xor eax, eax
leave
ret
push ebx
push esi
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00404794
push eax
push str.Starting_local_proxy_command:__s
mov dword [ebp - 0x10], eax
call fcn.00402d85
mov esi, eax
push esi
xor edi, edi
push edi
call fcn.00426217
push esi
call fcn.004029c8
xor ebx, ebx
push 0x20
inc ebx
push ebx
call fcn.00402908
mov esi, eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x18], eax
add esp, 0x28
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
mov dword [esi], 0x4452cc
mov dword [esi + 0x14], edi
push eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreatePipe]
push eax
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], edi
call ebx
test eax, eax
je 0x428999
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call ebx
test eax, eax
jne 0x4289ac
push dword [ebp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 4]
call edi
push str.Unable_to_create_pipes_for_proxy_command
call fcn.00402d85
pop ecx
mov dword [esi + 0x14], eax
jmp 0x428a57
mov ebx, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push edi
push 1
push dword [ebp - 0xc]
call ebx
push edi
push 1
push dword [ebp + 0x28]
call ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push edi
push 0x8000020
push 1
push edi
push edi
push dword [ebp - 0x10]
mov dword [ebp - 0x70], 0x44
push edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], 0x100
mov word [ebp - 0x3e], di
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 0xc]
push edi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x28]
push esi
mov dword [esi + 8], eax
push 0x428816
push dword [ebp + 0x28]
call fcn.0042675f
push edi
push esi
push 0x428855
push dword [esi + 4]
mov dword [esi + 0x10], eax
call fcn.004267fc
push dword [ebp + 8]
mov dword [esi + 0xc], eax
call fcn.00427845
add esp, 0x24
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x428a61
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040107b
add esp, 0xc
cmp eax, 0xffffffff
jne 0x428a80
pop ebp
jmp fcn.00426244
pop ebp
ret
Function at 0x428a82
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x428add
push esi
push esi
lea eax, [ebp - 4]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x438e64
push dword [ebp - 4]
call fcn.0042cca0
push dword [ebp - 4]
push eax
push str._.s
call fcn.00402d85
add esp, 0x14
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
leave
ret

Function at 0x428b20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x428b4a
xor eax, eax
jmp 0x428bc7
push edi
push 4
push 1
call fcn.00402908
mov edi, dword [ebp + 0xc]
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp - 4], eax
mov dword [eax], esi
je 0x428b6d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 4], eax
cmp dword [ebp + 0x10], ebx
jne 0x428b77
cmp dword [ebp + 0x14], ebx
je 0x428bc3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp dword [ebp + 0x14], ebx
mov edi, 0x989680
mov esi, 0x49ef6f00
je 0x428baa
push ebx
push edi
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.0042d6e0
mov ecx, dword [ebp + 0x14]
add eax, esi
mov dword [ecx], eax
cmp dword [ebp + 0x10], ebx
je 0x428bc3
push ebx
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0042d6e0
mov ecx, dword [ebp + 0x10]
add eax, esi
mov dword [ecx], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x428c2a
Capabilities:
Get file size

Disassembly:
push esi
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 0x40000000
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x428c4e
xor eax, eax
pop esi
ret
push ebx
push edi
push 4
push 1
call fcn.00402908
mov ebx, dword [esp + 0x1c]
test ebx, ebx
pop ecx
mov edi, eax
pop ecx
mov dword [edi], esi
je 0x428c72
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx + 4], eax
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x428d1a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x428d2c
xor eax, eax
ret
test al, 0x10
push 0
pop eax
setne al
inc eax
ret
Function at 0x428e4a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x428e66
xor eax, eax
inc eax
leave
ret
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x428e7f
xor eax, eax
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 2
pop eax
leave
ret

Function at 0x429298
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
cmp dword [0x44c5e4], 0
push ebx
push esi
push edi
jne 0x42936b
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
mov eax, dword [0x44837c]
cmp eax, 0xffffffff
jne 0x4292cd
or eax, 0xffffffff
jmp 0x429373
push eax
call fcn.0042810c
test eax, eax
pop ecx
je 0x4292e7
push 2
push dword [0x44837c]
call fcn.00427d40
pop ecx
pop ecx
xor ebx, ebx
inc ebx
lea eax, [ebp - 4]
push eax
push edi
call fcn.00425017
test eax, eax
pop ecx
pop ecx
je 0x429322
call esi
mov ecx, dword [ebp - 4]
sub ecx, eax
test ecx, ecx
jg 0x429307
mov ecx, ebx
mov eax, ecx
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
lea eax, [ebp - 0xc]
jmp 0x429324
xor eax, eax
mov ecx, dword [0x44837c]
push eax
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push ebx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x110], ebx
call dword [0x44c5dc]
test eax, eax
jl 0x4292c5
jne 0x429358
mov edi, dword [ebp - 4]
jmp 0x4292ea
call esi
push ebx
push dword [0x44837c]
call fcn.00427d40
pop ecx
xor eax, eax
jmp 0x429372
push 0xffffffffffffffff
call fcn.004290f3
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x429397
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, 0x4484b8
push esi
push dword [ebp + 8]
call fcn.0042cdcc
push esi
call fcn.0042b3cd
add esp, 0xc
xor esi, esi
cmp dword [0x44837c], 0xffffffff
jne 0x4293c5
cmp dword [ebp + 0xc], esi
jne 0x4293cd
cmp dword [0x44c5e4], esi
jne 0x4293da
push 0x448498
call fcn.00402bb0
pop ecx
jmp 0x42944c
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0x429378
push esi
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x42941d
push str.Unable_to_create_command_input_thread_n
push 0x4484d8
call fcn.0042bd3a
push 1
call fcn.00425f5f
add esp, 0xc
push edi
push dword [ebp - 0xc]
call fcn.004290f3
mov edi, eax
cmp edi, esi
pop ecx
jge 0x429446
push 0x2af
push str...windowswinsftp.c
push str.ret___0
call fcn.0042ae3d
add esp, 0xc
cmp edi, esi
je 0x42941e
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x4296de
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push dword [ebp + 0x14]
call fcn.0042a730
mov edi, eax
inc edi
push 1
push edi
call fcn.00402908
add esp, 0xc
push 1
push dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 0x20], ebx
call fcn.0042a730
push dword [ebp + 0x10]
mov esi, eax
call fcn.0042a730
pop ecx
lea eax, [esi + eax + 5]
pop ecx
lea eax, [eax + eax*2]
push eax
call fcn.00402908
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.0042969c
add esp, 0x14
lea eax, [ebp - 8]
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x42975b
xor eax, eax
inc eax
jmp 0x4298e7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
push dword [ebp - 8]
call esi
test eax, eax
mov dword [ebp - 0x10], eax
je 0x42989a
cmp eax, 0xea
je 0x42989a
push 0x43da58
push dword [ebp + 0x10]
call fcn.0042aa70
test eax, eax
pop ecx
pop ecx
jne 0x42989a
push 0x4392f4
push dword [ebp - 4]
call fcn.0042cca0
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx + 1]
mov dword [ebp - 0x18], eax
lea eax, [edi + 0xa]
push 1
push eax
call fcn.00402908
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
push dword [ebp - 8]
call esi
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x42989a
cmp dword [ebp - 0x14], 1
jne 0x42989a
mov edi, dword [ebp - 0x1c]
mov esi, ebx
mov dword [ebp - 0x18], 2
mov byte [esi], 0x30
inc esi
push 0x438514
mov byte [esi], 0x78
push edi
inc esi
call fcn.0042cca0
pop ecx
pop ecx
mov ecx, eax
push 4
cdq
pop ebx
idiv ebx
lea edx, [ecx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x42982f
cmp ecx, 1
jle 0x42983a
dec ecx
dec edx
mov eax, edx
xor eax, 3
cmp byte [eax + edi], 0x30
je 0x429828
xor ebx, ebx
test ecx, ecx
jle 0x429854
lea edx, [ecx + esi - 1]
mov eax, ebx
xor eax, 3
mov al, byte [eax + edi]
inc ebx
mov byte [edx], al
dec edx
cmp ebx, ecx
jl 0x429844
mov eax, dword [ebp - 0x1c]
lea edi, [edi + eax*4]
add esi, ecx
cmp byte [edi], 0
je 0x429866
inc edi
mov byte [esi], 0x2c
inc esi
dec dword [ebp - 0x18]
mov byte [esi], 0
jne 0x429803
push dword [ebp + 0x14]
mov ebx, dword [ebp - 0x20]
push ebx
call fcn.0042aa70
test eax, eax
pop ecx
pop ecx
jne 0x42989a
push ebx
call fcn.0042a730
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x14]
push ebx
call fcn.0042aa70
push ebx
mov esi, eax
call fcn.004029c8
push dword [ebp - 4]
call fcn.004029c8
add esp, 0x10
cmp dword [ebp - 0x10], 0xea
je 0x4298e4
cmp dword [ebp - 0x10], 0
jne 0x429753
cmp dword [ebp - 0x14], 1
jne 0x429753
test esi, esi
jne 0x4298e4
xor eax, eax
jmp 0x4298e7
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4298ec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 1
push dword [ebp + 8]
call fcn.0042a730
push dword [ebp + 0x10]
mov esi, eax
call fcn.0042a730
pop ecx
lea eax, [esi + eax + 5]
pop ecx
lea eax, [eax + eax*2]
push eax
call fcn.00402908
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042969c
add esp, 0x14
lea eax, [ebp - 4]
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x429964
push dword [ebp + 0x14]
call fcn.0042a730
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004029c8
pop ecx
pop esi
leave
ret
Function at 0x4299d9
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
mov word [ebp - 0x224], si
mov ecx, 0x84
lea edi, [ebp - 0x222]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push str.SoftwareSimonTathamPuTTY
mov ebx, 0x212
push 0x80000001
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x429a7b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.RandSeedFile
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x429a45
cmp dword [ebp - 0x10], 1
je 0x429a4c
mov byte [ebp - 0x224], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x224], 0
je 0x429a7b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea esi, [ebp - 4]
call fcn.0042996e
test eax, eax
pop ecx
jne 0x429bbb
xor esi, esi
cmp dword [0x44c290], esi
jne 0x429aa8
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, esi
mov dword [0x44c294], eax
je 0x429aa8
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44c298], eax
mov eax, dword [0x44c298]
cmp eax, esi
mov edi, str.PUTTY.RND
je 0x429b34
lea ecx, [ebp - 0x224]
push ecx
push esi
push esi
push 0x1c
push esi
call eax
test eax, eax
jl 0x429af4
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.0042be40
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea esi, [ebp - 4]
call fcn.0042996e
add esp, 0xc
test eax, eax
jne 0x429bbb
xor esi, esi
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push 0x1a
push esi
call dword [0x44c298]
test eax, eax
jl 0x429b34
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.0042be40
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea esi, [ebp - 4]
call fcn.0042996e
add esp, 0xc
test eax, eax
jne 0x429bbb
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
lea eax, [ebp - 0x224]
push eax
push str.HOMEDRIVE
call esi
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x224]
push eax
push str.HOMEPATH
call esi
test eax, eax
je 0x429b87
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.0042be40
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea esi, [ebp - 4]
call fcn.0042996e
add esp, 0xc
test eax, eax
jne 0x429bbb
push ebx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.0042be40
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea esi, [ebp - 4]
call fcn.0042996e
add esp, 0xc
test eax, eax
je 0x429bc0
mov eax, dword [ebp - 4]
jmp 0x429bc3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429bc8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push 1
call fcn.004299d9
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x429c23
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov edi, 0x400
jmp 0x429c05
cmp dword [ebp - 4], 0
je 0x429c1a
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
call dword [ebp + 8]
pop ecx
pop ecx
push 0
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
push ebx
call esi
test eax, eax
jne 0x429bf0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x429c26
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
call fcn.004299d9
mov esi, eax
cmp esi, 0xffffffff
pop ecx
je 0x429c54
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret

Function at 0x42cea9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x44c2f4], esi
push edi
jne 0x42cec9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x44c2f0], esi
mov byte [0x44c2ec], al
jne 0x42cf2f
mov ecx, dword [0x44c98c]
test ecx, ecx
je 0x42cf10
mov eax, dword [0x44c988]
sub eax, 4
cmp eax, ecx
jmp 0x42cf09
mov eax, dword [eax]
test eax, eax
je 0x42cefb
call eax
mov eax, dword [0x44c988]
sub eax, 4
cmp eax, dword [0x44c98c]
mov dword [0x44c988], eax
jae 0x42cef3
mov eax, 0x448020
mov esi, 0x448028
cmp eax, esi
mov edi, eax
jae 0x42cf2f
mov eax, dword [edi]
test eax, eax
je 0x42cf28
call eax
add edi, 4
cmp edi, esi
jb 0x42cf20
mov eax, 0x44802c
mov esi, 0x448030
cmp eax, esi
mov edi, eax
jae 0x42cf4e
mov eax, dword [edi]
test eax, eax
je 0x42cf47
call eax
add edi, 4
cmp edi, esi
jb 0x42cf3f
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x42cf68
push dword [ebp + 8]
mov dword [0x44c2f4], 1
call fcn.0042ce0f
pop ebp
ret
Function at 0x42d812
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x445f10
call fcn.0042ec24
mov edi, 0x94
mov eax, edi
call fcn.0042cc60
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x44c2b4], ecx
mov eax, dword [esi + 4]
mov dword [0x44c2c0], eax
mov edx, dword [esi + 8]
mov dword [0x44c2c4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x44c2b8], esi
cmp ecx, 2
je 0x42d872
or esi, 0x8000
mov dword [0x44c2b8], esi
shl eax, 8
add eax, edx
mov dword [0x44c2bc], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x42d8ab
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42d8ab
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x42d8c3
cmp eax, 0x20b
je 0x42d8b0
mov dword [ebp - 0x1c], edi
jmp 0x42d8d7
cmp dword [ecx + 0x84], 0xe
jbe 0x42d8ab
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x42d8d1
cmp dword [ecx + 0x74], 0xe
jbe 0x42d8ab
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push edi
call fcn.0042ffb1
pop ecx
test eax, eax
jne 0x42d903
cmp dword [0x44c304], 2
je 0x42d8f0
call fcn.00431fed
push 0x1c
call fcn.00431e76
push 0xff
call fcn.0042ce0f
pop ecx
pop ecx
call fcn.00431dee
mov dword [ebp - 4], edi
call fcn.0042f7a3
test eax, eax
jge 0x42d91c
push 0x1b
call fcn.0042d7ed
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x44c980], eax
call fcn.0043283e
mov dword [0x44c2fc], eax
call fcn.0043279c
test eax, eax
jge 0x42d942
push 8
call fcn.0042d7ed
pop ecx
call fcn.00432569
test eax, eax
jge 0x42d953
push 9
call fcn.0042d7ed
pop ecx
push 1
call fcn.0042ce3f
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x42d969
push eax
call fcn.0042d7ed
pop ecx
mov eax, dword [0x44c2d4]
mov dword [0x44c2d8], eax
push eax
push dword [0x44c2cc]
push dword [0x44c2c8]
call fcn.0042944f
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x42d998
push esi
call fcn.0042cf6a
call fcn.0042cf8c
jmp 0x42d9ca
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.0042ec5f
ret