joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416ad3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [edi + 0x44], 0
je 0x416b0f
cmp byte [edi + 0x45], 0
jne 0x416b0f
push esi
push 0xef
call fcn.005975b1
push esi
push 0xbb
call fcn.005975b1
push esi
push 0xbf
call fcn.005975b1
add esp, 0x18
mov eax, dword [edi]
xor ebx, ebx
push ebx
push esi
mov ecx, edi
call dword [eax + 4]
cmp byte [edi + 0x45], bl
je 0x416c10
push 2
pop eax
push eax
push ebx
push esi
call fcn.00597a35
push esi
call fcn.0059806b
push ebx
push ebx
push esi
mov edi, eax
call fcn.00597a35
add esp, 0x1c
test edi, edi
jg 0x416b4c
xor al, al
jmp 0x416c1c
lea eax, [edi + 1]
push eax
call fcn.00506f2d
push esi
mov ebx, eax
push 1
push edi
push ebx
mov dword [ebp - 4], ebx
mov byte [ebx], 0
call fcn.005885cb
xor ecx, ecx
add esp, 0x14
mov byte [ebx + edi], cl
cmp eax, 1
je 0x416b81
push ebx
call fcn.00506f36
xor al, al
jmp 0x416c1b
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ecx
push ecx
push 0xffffffffffffffff
push ebx
push ecx
push 0xfde9
call edi
xor ecx, ecx
mov esi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00506f2d
lea ecx, [esi + esi]
mov ebx, eax
push ecx
push 0
push ebx
call fcn.0056b050
add esp, 0x10
push esi
mov esi, dword [ebp - 4]
push ebx
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call edi
push esi
call fcn.00506f36
mov esi, dword [ebp + 8]
push 0
push 0
push esi
call fcn.00597a35
push esi
push 0xff
call fcn.005975b1
push esi
push 0xfe
call fcn.005975b1
push ebx
call fcn.0057600b
push esi
push eax
push 2
pop eax
push eax
push ebx
call fcn.00598306
push ebx
call fcn.00506f36
add esp, 0x38
push esi
call fcn.00597538
neg eax
sbb eax, eax
inc eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x423ead
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x423ee1
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423ee1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x423f93
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x423efe
cmp ax, 0x5c
jne 0x423f00
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x423ef2
cmp esi, ebx
je 0x423f46
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.0056a550
add esp, 0xc
cmp esi, 0x208
jae 0x423fa3
xor eax, eax
mov word [ebp + esi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.00423ead
pop ecx
pop ecx
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x423f63
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0059b3fb
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0059b3ca
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423f93
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret
call fcn.00507171
int3

Function at 0x4247ed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x424899
cmp dword [esi + 4], 0xffffffff
jne 0x424899
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.0057600b
pop ecx
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x424840
cmp eax, 0x2f
je 0x424840
push 0x5eb8d4
push edi
call fcn.0059b3ca
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x424862
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x424862
mov eax, 0x2000000
jmp 0x42489e
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00426fc5
add esp, 0x10
test eax, eax
jne 0x424880
mov eax, dword [ebp - 4]
jmp 0x42489e
push eax
call fcn.004277a1
pop ecx
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x42489e
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x424e0a
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x5eb910]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x4270c4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4270f8
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4270f3
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x42711f
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x427108
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.0056a550
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x427237
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x427245
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x427304
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
sub edi, 1
jne 0x42725d
pop edi
test esi, esi
je 0x427320
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5eb910]
inc edx
sub esi, 1
jne 0x427308
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x429980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42998e
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x429a4d
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
sub edi, 1
jne 0x4299a6
pop edi
test esi, esi
je 0x429a69
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
inc edx
sub esi, 1
jne 0x429a51
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x42a146
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov ecx, edi
mov ebx, edi
mov dword [ebp - 4], ecx
mov dword [esi + 0x6af80], 2
jmp 0x42a34b
cmp dword [esi + 0x6af90], 3
jb 0x42a1c3
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x42a200
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x42a200
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x42a1ea
mov dword [esi + 0x6afa0], eax
push ecx
push esi
call fcn.0042acf2
pop ecx
pop ecx
mov ecx, dword [esi + 0x6af90]
mov ebx, eax
cmp ebx, ecx
cmova ebx, ecx
cmp ebx, 3
jb 0x42a2d6
lea eax, [ebx - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.00429ca7
sub dword [esi + 0x6af90], ebx
add esp, 0xc
mov dword [ebp + 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x42a29d
cmp dword [esi + 0x6af90], 3
jb 0x42a29d
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub ebx, 1
jne 0x42a23e
mov eax, dword [ebp + 8]
jmp 0x42a2f5
add dword [esi + 0x6af84], ebx
mov ebx, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp + 8]
jmp 0x42a2fb
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push edi
push esi
call fcn.00429ca7
add esp, 0xc
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x42a335
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x42a313
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x42a315
mov edx, edi
mov eax, dword [esi + 0x6af84]
push edi
sub eax, ecx
push eax
push edx
push esi
call fcn.0042a55f
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x42a348
push esi
call fcn.0042a41c
pop ecx
mov ecx, dword [ebp - 4]
cmp dword [esi + 0x6af90], edi
jne 0x42a168
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x42a369
lea edi, [esi + 0x1af70]
add edi, ecx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push edi
push esi
call fcn.0042a55f
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42abc6
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x42abe4
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x42ac08
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.0056b050
movzx eax, word [ebx*8 + 0x5ec65a]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x5ec658]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x5ec65c]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x5ec65e]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x42ac6b
mov eax, dword [ebp + 0x10]
or word [eax], 4
jmp 0x42ac76
cmp ebx, 8
jl 0x42ac76
mov eax, dword [ebp + 0x10]
or word [eax], cx
push 0x10000
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push ebx
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x42acdd
cmp eax, 0xffffffff
je 0x42acdd
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x42acb8
push esi
call fcn.0042a41c
pop ecx
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x42acc0
jmp 0x42aced
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42babf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x42bb15
mov eax, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp eax, esi
jae 0x42bb52
sub esi, eax
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
add eax, ecx
push esi
push eax
push dword [ebp + 8]
call fcn.0056a550
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x78]
call fcn.00429980
add esp, 0x18
mov dword [edi + 0x78], eax
mov eax, esi
jmp 0x42bb54
cmp dword [edi + 0x7c], 0
je 0x42bb4b
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42bb52
mov esi, dword [ebp - 4]
add dword [edi + 0x74], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x78]
call fcn.00429980
add esp, 0xc
jmp 0x42bb0e
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x42bfdc
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x5ec6d0]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ec6d0]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x42c025
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x42c09e
cmp dword [esi + 0x3c], 0
je 0x42c057
cmp dword [esi + 0x40], edi
jae 0x42c051
push dword [esi + 0x3c]
call fcn.00506f36
and dword [esi + 0x3c], 0
pop ecx
cmp dword [esi + 0x3c], 0
jne 0x42c067
lea eax, [edi + edi]
push eax
call fcn.00506f2d
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push dword [esi + 0x3c]
call fcn.0056a550
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x42c09b
lea ecx, [esi + 0x30]
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
push ecx
call fcn.0042c0f8
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
lea ecx, [esi + 0x30]
cmp ebx, edi
jb 0x42c07d
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42c0cd
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x42c0b9
mov dword [esi + 0x14], 0x30000
jmp 0x42c0ef
push edi
add ecx, edx
push ebx
push ecx
call fcn.0056a550
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
jmp 0x42c0f1
mov eax, dword [esi + 4]
test eax, eax
je 0x42c0e8
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x42c0f1
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42e706
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x5c460f
call fcn.00506dc7
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x42e724
xor al, al
jmp 0x42e7ff
add eax, 0xfffffff0
push eax
call fcn.00412393
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
mov eax, dword [esi - 0xc]
lea ecx, [ebp + 8]
xor ebx, ebx
dec eax
push eax
mov dword [ebp - 4], ebx
call fcn.0042eba7
push 0x5c
pop ecx
cmp ax, cx
je 0x42e75a
push ecx
lea ecx, [ebp + 8]
call fcn.0042e49c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
call fcn.0041279d
push eax
lea ecx, [ebp - 0x10]
call fcn.00411d94
xor edi, edi
mov byte [ebp - 4], 2
cmp dword [esi - 0xc], edi
jle 0x42e7bd
push edi
lea ecx, [ebp + 8]
call fcn.0042eba7
push 0x5c
pop ecx
cmp ax, cx
je 0x42e79f
push edi
lea ecx, [ebp + 8]
call fcn.0042eba7
movzx eax, ax
jmp 0x42e7ae
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042e1b5
push 0x5c
pop eax
push eax
lea ecx, [ebp - 0x10]
call fcn.0042e49c
inc edi
cmp edi, dword [esi - 0xc]
jl 0x42e780
xor edi, edi
cmp dword [ebp - 0x18], edi
jle 0x42e7e2
push edi
lea ecx, [ebp - 0x1c]
call fcn.0042def1
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
inc edi
cmp edi, dword [ebp - 0x18]
jl 0x42e7c4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00412ac4
lea ecx, [ebp - 0x1c]
call fcn.00434a10
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov al, bl
call fcn.00506d90
ret

Function at 0x42e961
Capabilities:
Query environment variable

Disassembly:
push 0x80c
mov eax, 0x5c4654
call fcn.00506dfb
mov esi, dword [ebp + 8]
and dword [ebp - 0x814], 0
mov dword [ebp - 0x818], esi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
add edi, 0xfffffff0
inc ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
mov dword [esp], 0x800
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 0x814], ebx
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x1f4
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x42e9f1
lea eax, [ebp - 0x810]
push eax
push 0x5ed240
push esi
call fcn.00412690
add esp, 0xc
mov ecx, esi
call fcn.00435d4e
mov ecx, eax
call fcn.00435c76
mov ecx, edi
call fcn.00412ac4
mov eax, esi
call fcn.00506da5
ret

Function at 0x42ea00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x42ea26
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42ea26
test al, 0x10
jne 0x42ea26
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x42ed06
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 4]
push eax
xor esi, esi
mov eax, dword [edi + 4]
or eax, 1
push eax
push esi
push dword [edi + 0x10]
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [edi], eax
test eax, eax
jne 0x42ed63
push esi
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi], eax
push dword [ebp - 4]
test eax, eax
jne 0x42ed5d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
jmp 0x42ed63
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42f83b
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
or ebx, 0xffffffff
push edi
push 4
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, ebx
je 0x42f919
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x1c
push eax
push esi
call sub.KERNEL32.dll_Thread32First
jmp 0x42f90a
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x34], eax
jne 0x42f900
push dword [ebp - 0x38]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edx, eax
mov dword [ebp - 0x4c], edx
test edx, edx
je 0x42f900
and dword [ebp - 0x24], 0
lea edi, [ebp - 0x20]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
test eax, eax
je 0x42f8f4
movzx ecx, word [ebp - 0x20]
movzx eax, word [ebp - 0x24]
shl ecx, 0x10
or eax, ecx
cdq
mov ecx, eax
or eax, edx
je 0x42f8f4
cmp edx, dword [ebp - 0x48]
ja 0x42f8f4
jb 0x42f8e7
cmp ecx, ebx
jae 0x42f8f4
mov edi, dword [ebp - 0x38]
mov ebx, ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edi
jmp 0x42f8f7
mov edi, dword [ebp - 0x44]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x40]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x42f881
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret
Function at 0x4317c3
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x234
mov eax, 0x5c4e3f
call fcn.00506dfb
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
mov esi, eax
call fcn.0041279d
push eax
lea ecx, [ebp - 0x240]
call fcn.00411d94
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0043193c
test esi, esi
je 0x431874
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.0041421f
lea ecx, [ebp - 0x240]
call fcn.0043193c
push dword [ebp + 8]
lea ecx, [ebp - 0x240]
call fcn.0042e677
test eax, eax
je 0x43185d
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43181b
jmp 0x431874
push ebx
push dword [ebp - 0x234]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.00506da5
ret 4