joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4219e0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x90
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
mov ebx, dword [esp + 0x98]
push esi
mov esi, ecx
xor ecx, ecx
push 0x7e
xor eax, eax
push ecx
lea edx, [esp + 0x1e]
push edx
mov dword [esp + 0x14], esi
mov word [esp + 0x18], ax
mov dword [esp + 0x1a], eax
mov word [esp + 0x1e], ax
mov word [esp + 0x20], cx
call fcn.0044e9d0
add esp, 0xc
test ebx, ebx
je 0x421adf
test esi, esi
je 0x421adf
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push edi
mov edi, 0x41
push 0x40
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
mov eax, 0x3a
push edx
mov word [esp + 0x20], di
mov word [esp + 0x22], ax
call ebp
test eax, eax
je 0x421a94
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421a70
sub eax, edx
sar eax, 1
mov esi, eax
push esi
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0044dbc7
add esp, 0xc
test eax, eax
je 0x421ab6
inc edi
cmp di, 0x5a
jb 0x421a47
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x90
ret
mov eax, dword [esp + 0x10]
lea ecx, [ebx + esi*2]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x475b48
push 0xffffffffffffffff
push 0x104
push eax
call fcn.0044c3fb
add esp, 0x18
mov eax, 1
jmp 0x421a9d
mov ecx, dword [esp + 0x94]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0044b6ee
add esp, 0x90
ret

Function at 0x4225e0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x468598
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
xor ecx, ecx
cmp eax, ecx
jne 0x4226d2
xor eax, eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ecx
mov word [esp + 0x10], ax
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0xc]
call fcn.004090f0
test eax, eax
jne 0x42265a
cmp dword [esp + 0x24], 8
jb 0x422656
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x4226d2
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x422669
lea eax, [esp + 0x10]
push eax
lea edi, [esi + 0x18]
push str._s360Protect.dat
push edi
mov ecx, 0x104
call fcn.00402ee0
add esp, 0xc
test eax, eax
jge 0x4226a1
xor edx, edx
cmp dword [esp + 0x24], 8
mov word [edi], dx
jb 0x422656
mov eax, dword [esp + 0x10]
push eax
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x4226d2
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4226be
xor ecx, ecx
lea esi, [esp + 0xc]
mov word [edi], cx
call fcn.00402290
xor eax, eax
jmp 0x4226d2
mov dword [esi], 1
lea esi, [esp + 0xc]
call fcn.00402290
mov eax, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x2c
ret
Function at 0x4226f0
Capabilities:
Delete file

Disassembly:
sub esp, 0x128
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
mov ebx, dword [esp + 0x130]
push ebp
push esi
push edi
push 0x4db040
push 0x3e4
xor ebp, ebp
call fcn.0044dca1
add esp, 8
test eax, eax
je 0x422843
lea edi, [ebx + 0x18]
push edi
mov esi, eax
call fcn.00423130
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x422843
push esi
call fcn.00423730
test eax, eax
jne 0x42275a
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x422831
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.004237a0
mov edi, eax
test edi, edi
je 0x422831
mov eax, dword [esp + 0x14]
cmp eax, 0x64000
ja 0x422831
lea esi, [eax + 1]
push 0x4db040
push esi
call fcn.0044c41c
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x42282d
push esi
push 0
push ebp
call fcn.0044e9d0
add esp, 0xc
test esi, esi
je 0x4227bc
cmp esi, 0x7fffffff
ja 0x4227bc
push edi
mov edx, esi
mov ecx, ebp
call fcn.004228a0
lea esi, [ebx + 0x338]
push esi
mov eax, ebp
call fcn.00423890
test eax, eax
je 0x42282d
push 0x476028
push str.general
mov ecx, esi
call fcn.00423b90
mov esi, dword [esp + 0x10]
mov dword [ebx + 8], eax
add esi, 0xb8
mov ecx, 0x46
lea edi, [esp + 0x18]
lea eax, [ebx + 0x220]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x68]
mov esi, dword [esp + 0x28]
test eax, eax
je 0x42281e
mov ecx, dword [eax + 0x50]
cmp edx, ecx
ja 0x422817
jne 0x42281e
cmp esi, dword [eax + 0x10]
jbe 0x42281e
mov eax, 1
jmp 0x422820
xor eax, eax
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], edx
test eax, eax
je 0x42282d
mov dword [ebx + 4], eax
mov esi, dword [esp + 0x10]
call fcn.00422860
test ebp, ebp
je 0x422843
push ebp
call fcn.0044c759
add esp, 4
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x128
ret 4

Function at 0x4231c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1e0
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x1dc], eax
push ebx
mov ebx, dword [esp + 0x1e8]
mov eax, dword [ebx]
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
cmp eax, 0xffffffff
je 0x423295
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x423295
mov edx, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea eax, [esp + 0x18]
push eax
push 0x118
lea ecx, [esp + 0x24]
push ecx
push edx
call ebp
test eax, eax
je 0x423295
cmp dword [esp + 0x18], 0x54444851
jne 0x423295
cmp dword [esp + 0x1c], 0x118
ja 0x423295
mov edx, dword [ebx]
push 0
lea eax, [esp + 0x18]
push eax
lea edi, [ebx + 0xb8]
mov ecx, 0x46
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push 0xb4
lea ecx, [esp + 0x13c]
push ecx
push edx
call ebp
test eax, eax
je 0x423295
lea eax, [esp + 0x130]
push eax
mov ecx, ebx
call fcn.004232c0
test eax, eax
je 0x423295
mov edi, ebx
call fcn.00423390
test eax, eax
je 0x423295
mov eax, 1
mov dword [ebx + 0x3dc], eax
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1ec]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x1e0
ret 4
Function at 0x4232c0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc0
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xc4]
push esi
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x3e0]
lea edi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0041a0f0
add esp, 8
cmp dword [esp + 0xc], 0x74
jne 0x42336d
lea edx, [esp + 0x20]
push str.www.360.cn
push edx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x42336d
mov ecx, dword [esi]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x42336d
cmp dword [esp + 8], 0
jne 0x42336d
cmp eax, dword [esp + 0x70]
jne 0x42336d
lea edx, [esi + 0x1d0]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x42336d
lea edi, [esi + 4]
mov ecx, 0x2d
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
jmp 0x42336f
xor eax, eax
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
xor ecx, esp
call fcn.0044b6ee
add esp, 0xc0
ret 4

Function at 0x423390
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x84
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x7c], eax
mov eax, dword [edi]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x4234d7
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4234d7
mov ecx, dword [edi]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4234d7
cmp dword [esp + 0xc], ebx
jne 0x4234d7
push 0x4db040
push esi
call fcn.0044c41c
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4234bf
mov eax, dword [edi]
push 0
lea edx, [esp + 0x18]
push edx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42349c
push 0xb4
lea ecx, [ebx + 0x118]
push 0
push ecx
call fcn.0044e9d0
lea eax, [esp + 0x24]
call fcn.00418e60
push ebx
mov eax, esi
lea ecx, [esp + 0x28]
call fcn.00419570
add esp, 0x10
lea esi, [esp + 0x18]
lea ecx, [esp + 0x74]
call fcn.00419610
lea eax, [edi + 4]
lea edx, [esp + 0x74]
mov ecx, 0x10
sub edx, eax
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x42349c
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x423466
push ebx
mov esi, 1
call fcn.0044c759
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x84
ret
mov esi, dword [esp + 0x10]
push ebx
call fcn.0044c759
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x84
ret
mov eax, dword [esp + 0x10]
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x84
ret
mov ecx, dword [esp + 0x84]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x84
ret
Function at 0x4234f0
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [esp + 0x130]
push ebx
mov dword [esp + 8], eax
mov eax, dword [esi + 0x3d8]
push ebp
push edi
test eax, eax
jne 0x423710
mov al, 0x6d
mov byte [esp + 0x120], al
mov byte [esp + 0x12d], al
mov byte [esp + 0x133], al
mov eax, dword [esi]
xor edi, edi
mov bl, 0xb1
mov dl, 0x68
mov cl, 0x8d
mov dword [esp + 0x14], edi
mov byte [esp + 0x114], 0x3a
mov byte [esp + 0x115], 0x48
mov byte [esp + 0x116], 0x6b
mov byte [esp + 0x117], 0xa2
mov byte [esp + 0x118], 0x57
mov byte [esp + 0x119], 0x27
mov byte [esp + 0x11a], bl
mov byte [esp + 0x11b], 0x80
mov byte [esp + 0x11c], 0xd
mov byte [esp + 0x11d], 0x50
mov byte [esp + 0x11e], dl
mov byte [esp + 0x11f], cl
mov byte [esp + 0x121], 0x72
mov byte [esp + 0x122], 0xb
mov byte [esp + 0x123], 0xe2
mov byte [esp + 0x124], 0xc6
mov byte [esp + 0x125], 0x78
mov byte [esp + 0x126], 0xff
mov byte [esp + 0x127], 0x31
mov byte [esp + 0x128], 0x22
mov byte [esp + 0x129], 0xcb
mov byte [esp + 0x12a], 0x44
mov byte [esp + 0x12b], 0x63
mov byte [esp + 0x12c], bl
mov byte [esp + 0x12e], 0x1b
mov byte [esp + 0x12f], 0x95
mov byte [esp + 0x130], 0xf5
mov byte [esp + 0x131], dl
mov byte [esp + 0x132], cl
cmp eax, 0xffffffff
je 0x42370e
cmp dword [esi + 0x3dc], edi
je 0x42370e
push edi
push edi
push 0x1cc
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x42370e
mov ecx, dword [esi + 0x68]
push 0x4db040
push ecx
call fcn.0044c41c
mov edx, dword [esi + 0x68]
add edx, 0x20
push 0x4db040
push edx
mov ebx, eax
call fcn.0044c41c
add esp, 0x10
mov ebp, eax
test ebx, ebx
je 0x4236f0
test ebp, ebp
je 0x4236fd
mov ecx, dword [esi + 0x64]
mov edx, dword [esi]
push edi
lea eax, [esp + 0x18]
push eax
sub ecx, 0x1cc
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4236f0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x118]
call fcn.004170c0
mov edx, dword [esi + 0x68]
add esp, 4
lea ecx, [esp + 0x18]
push ecx
push edx
push ebx
lea edi, [esp + 0x130]
mov ecx, ebp
call fcn.00418030
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x3d8], ebx
mov edi, ebx
test eax, eax
je 0x4236e3
mov ecx, dword [esi + 0x68]
mov dword [eax], ecx
push ebp
call fcn.0044c759
add esp, 4
mov eax, edi
jmp 0x423710
test ebp, ebp
je 0x4236fd
push ebp
call fcn.0044c759
add esp, 4
test ebx, ebx
je 0x4236ec
push ebx
call fcn.0044c759
add esp, 4
mov eax, edi
jmp 0x423710
xor eax, eax
mov ecx, dword [esp + 0x134]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x12c
ret 4
Function at 0x426660
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
push ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x4266f9
push ebp
push esi
call fcn.0044c68f
mov ebp, eax
add esp, 4
cmp ebp, edi
je 0x4266ef
mov ecx, dword [esp + 0x10]
push ebp
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4266e6
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x4743d0
push ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4266e6
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
cmp eax, edi
je 0x4266d4
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x4266e1
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
mov edi, 1
push ebp
call fcn.0044c4f7
add esp, 4
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x426840
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x46980d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x24], 0
push 0x24
mov dword [esp + 0x10], 0
call fcn.0044b9c0
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x24], 1
test edi, edi
je 0x426899
lea eax, [edi + 4]
push eax
call fcn.00426f70
jmp 0x42689b
xor edi, edi
mov byte [esp + 0x24], 0
test edi, edi
je 0x42690c
mov eax, dword [esp + 0x2c]
lea esi, [edi + 4]
lea ecx, [esp + 0x30]
mov dword [edi], eax
cmp esi, ecx
je 0x4268d8
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea edx, [esp + 0x20]
push edx
mov eax, esi
call fcn.00426ff0
lea eax, [esp + 0x30]
push eax
mov eax, esi
call fcn.004270d0
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
push 0x426710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4268fc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42690c
mov ecx, edi
call fcn.00426940
push edi
call fcn.0044b6e3
add esp, 4
lea esi, [esp + 0x30]
mov dword [esp + 0x24], 2
call fcn.004273a0
mov edx, dword [esp + 0x30]
push edx
call fcn.0044b6e3
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x4269a0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 8
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esp + 0x10], eax
jbe 0x426a26
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x18]
push ebx
push esi
mov dword [esp + 0xc], eax
neg ebp
push edi
xor esi, esi
cmp dword [esp + 0x28], esi
jbe 0x426a06
lea esp, [esp]
mov ecx, dword [esp + 0x24]
lea ebx, [esi + ecx]
lea edx, [ebx + ebp]
cmp edx, dword [esp + 0x20]
jae 0x426a06
mov eax, dword [esp + 0x10]
lea edi, [eax + esi]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x426a20
mov bl, byte [ebx]
cmp byte [edi], bl
je 0x4269ff
cmp bl, 0xcc
jne 0x426a06
inc esi
cmp esi, dword [esp + 0x28]
jb 0x4269d0
cmp esi, dword [esp + 0x28]
je 0x426a2a
mov eax, dword [esp + 0x14]
inc dword [esp + 0x10]
inc eax
inc ebp
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x20]
jb 0x4269c1
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 8
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
lea eax, [ecx + edx]
pop ebp
add esp, 8
ret
Function at 0x428c10
Capabilities:
Enumerate threads

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x1c
push ebx
push ebp
push edi
push eax
push 4
xor ebp, ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x428d64
test ebx, ebx
je 0x428d64
xor eax, eax
push esi
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], eax
mov edi, 0x1c
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], edi
xor esi, esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x428d44
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x1c], edx
jne 0x428c7f
inc esi
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x428c74
test esi, esi
je 0x428d44
add esi, esi
add esi, esi
push esi
call fcn.0044c68f
mov edi, dword [esp + 0x34]
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x428d48
push esi
push 0
push eax
call fcn.0044e9d0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push ebx
xor esi, esi
mov dword [esp + 0x18], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x428d3a
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x1c], edx
jne 0x428d23
mov eax, dword [esp + 0x18]
push eax
push 0
push 0xa
call ebp
cmp eax, 0xffffffff
je 0x428d0c
mov ecx, dword [esp + 0x38]
push ecx
mov edi, eax
call fcn.00428dd0
mov edi, dword [esp + 0x30]
jmp 0x428d0f
or eax, 0xffffffff
mov edx, dword [edi]
mov dword [edx + esi*4], eax
mov eax, dword [edi]
mov eax, dword [eax + esi*4]
cmp eax, 0xffffffff
je 0x428d23
test eax, eax
je 0x428d23
inc esi
lea ecx, [esp + 0x10]
push ecx
push ebx
mov dword [esp + 0x18], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x428ce0
mov dword [edi + 4], esi
mov ebp, 1
jmp 0x428d48
mov edi, dword [esp + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
test ebp, ebp
jne 0x428d6d
call fcn.00428d80
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
mov edi, dword [esp + 0x2c]
call fcn.00428d80
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x428d80
Capabilities:
Resume thread

Disassembly:
push esi
xor esi, esi
cmp dword [edi + 4], esi
jbe 0x428dae
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
mov ecx, dword [eax + esi*4]
push ecx
call ebx
mov edx, dword [edi]
mov eax, dword [edx + esi*4]
push eax
call ebp
inc esi
cmp esi, dword [edi + 4]
jb 0x428d96
pop ebp
pop ebx
mov ecx, dword [edi]
push ecx
call fcn.0044c4f7
add esp, 4
mov dword [edi], 0
mov dword [edi + 4], 0
pop esi
ret
Function at 0x428dd0
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 0x2d8
push ebp
xor ebp, ebp
cmp edi, ebp
je 0x428edc
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x428ec9
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x10001
mov dword [esp + 0xc], ebp
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x428edc
mov ecx, dword [esp + 0x2e0]
add ecx, 0x2014
push ebx
mov dword [esp + 0xc], ecx
push esi
jmp 0x428e30
mov edx, dword [esp + 0xd0]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x14], edx
xor ebx, ebx
mov eax, dword [esi]
test eax, eax
je 0x428e8f
cmp dword [esi + 4], 0
je 0x428e8f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x428e8f
cmp edx, eax
jb 0x428e86
add ecx, eax
cmp edx, ecx
jae 0x428e86
push edi
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebp, 3
jge 0x428eb4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x14]
inc ebp
inc ebx
sub esi, 0xffffff80
cmp ebx, 2
jb 0x428e41
cmp dword [esp + 0xc], 0
je 0x428ea6
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x428e30
pop esi
pop ebx
mov eax, edi
pop ebp
add esp, 0x2d8
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0x2d8
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebp
add esp, 0x2d8
ret 4
mov eax, edi
pop ebp
add esp, 0x2d8
ret 4
Function at 0x42b3f0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x150
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x14c], eax
mov eax, dword [esp + 0x154]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42b44f
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0xc], 0
je 0x42b468
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x150
ret
test eax, eax
je 0x42b448
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x40
lea edx, [esp + 0x11c]
push edx
push esi
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x42b448
mov eax, 0x5a4d
cmp word [esp + 0x110], ax
jne 0x42b448
mov edx, dword [esp + 0x14c]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x42b448
push 0
lea eax, [esp + 0x14]
push eax
push 0xf8
lea ecx, [esp + 0x24]
push ecx
push esi
call edi
test eax, eax
je 0x42b448
cmp dword [esp + 0x18], 0x4550
push esi
jne 0x42b449
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x154]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0044b6ee
add esp, 0x150
ret

Function at 0x42b520
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
lea eax, [esp + 0xc]
push eax
xor ebp, ebp
push ebx
mov dword [esp + 0x14], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
jne 0x42b54a
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push edi
push esi
call fcn.0044c68f
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x42b564
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push edi
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42b5a5
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x4743d0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42b5a5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x24]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov ebp, 1
push edi
call fcn.0044c4f7
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x42b660
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea ecx, [esp + 0x1a]
xor eax, eax
push esi
push ecx
xor ebx, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov word [esp + 0x20], ax
call fcn.0044e9d0
add esp, 0xc
push 0x104
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [esp + 0x14]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x42b6b4
mov ecx, 0xb
mov esi, str._system32Shell32.dll
lea eax, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0042b520
add esp, 0xc
test eax, eax
je 0x42b700
cmp dword [esp + 0x10], 0x60002
jb 0x42b700
cmp dword [esp + 0xc], 0x3ab10000
mov eax, 1
jae 0x42b702
mov eax, ebx
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x214
ret