joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4216fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x42c
mov eax, 0x457a99
call fcn.00447347
mov eax, dword [ebp + 8]
mov esi, edx
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, ebx
jne 0x421755
call fcn.0041c5a4
mov esi, eax
jmp 0x42187a
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x42176e
call fcn.0041c5a4
jmp 0x42186c
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, ebx
je 0x421764
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x42c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4217ab
mov esi, 0x8007000e
jmp 0x42186e
mov byte [ebp - 4], 2
and dword [ebp - 0x420], 0
mov ecx, dword [ebp - 0x420]
shld ecx, eax, 1
mov dword [ebp - 0x420], ecx
add eax, eax
mov dword [ebp - 0x424], eax
cmp ecx, ebx
ja 0x4217d7
cmp eax, 0xffffffff
jbe 0x4217e1
push 0x80070216
call fcn.0041331b
cmp eax, 0x400
jbe 0x4217f7
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.004206be
jmp 0x421803
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x421821
cmp dword [ebp - 0x418], ebx
je 0x4217a1
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x421764
xor ecx, ecx
mov edx, dword [ebp - 0x418]
mov word [edx + eax*2], cx
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x434]
call fcn.00421596
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x421896
lea eax, [ebp - 0x418]
call fcn.004206b0
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004473b2
ret 0xc
Function at 0x421bd6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x418], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
mov ebx, ecx
push eax
mov dword [ebp - 0x41c], ebx
call fcn.00427b40
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00427b40
add esp, 0x18
test ebx, ebx
jne 0x421c3c
xor eax, eax
jmp 0x421cb9
cmp dword [ebp - 0x418], 0
je 0x421c38
lea ebx, [ebp - 0x414]
call fcn.00421e6d
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x40fcb0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421c70
sub eax, edx
sar eax, 1
mov esi, 0x104
cmp eax, esi
ja 0x421c38
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
push 0x40f65c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x41c]
call fcn.0042250d
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004224f9
leave
ret 4
Function at 0x421cce
Capabilities:
Copy file
Create process on windows
Get common file path
Self delete

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x41c], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0x418], ebx
call fcn.00427b40
xor eax, eax
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push esi
push eax
call fcn.00427b40
xor eax, eax
mov dword [ebp - 0x42c], esi
lea edi, [ebp - 0x428]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x46c]
push esi
push eax
call fcn.00427b40
add esp, 0x24
mov dword [ebp - 0x470], 0x44
cmp ebx, esi
je 0x421e55
cmp dword [ebp - 0x41c], esi
je 0x421e55
lea ebx, [ebp - 0x20c]
call fcn.00421e6d
mov eax, ebx
push eax
push esi
push 0x40fcb8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
mov eax, ebx
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x421e55
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
cmp edi, esi
je 0x421e55
push 0x40fcc0
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [ebp - 0x418], eax
cmp eax, esi
je 0x421e55
push dword [ebp - 0x41c]
mov eax, ebx
push edi
push eax
push 0x40fce4
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push 0x103
push eax
call fcn.00422e28
add esp, 0x1c
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x470]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x414]
push eax
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x42c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call edi
push dword [ebp - 0x428]
call edi
cmp ebx, esi
je 0x421e55
push 0x1b58
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x421e49
inc esi
push dword [ebp - 0x418]
call edi
mov eax, esi
jmp 0x421e57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004224f9
leave
ret 4
Function at 0x421e6d
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x928
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp ebx, edi
jne 0x421e90
xor eax, eax
jmp 0x42202e
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x421e89
push esi
mov esi, 0x114
push esi
lea eax, [ebp - 0x918]
push edi
push eax
call fcn.00427b40
add esp, 0xc
lea eax, [ebp - 0x918]
push eax
mov dword [ebp - 0x918], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x421ed7
cmp dword [ebp - 0x914], 5
ja 0x421efb
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x421efb
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x421eeb
jmp 0x422029
lea eax, [ebp - 0x91c]
push eax
push 0x20019
push edi
push 0x40eed8
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421fec
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0x920]
push eax
push edi
push edi
push 0x40ef3c
push dword [ebp - 0x91c]
mov dword [ebp - 0x920], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x924], 4
call edi
test eax, eax
jne 0x421f68
cmp dword [ebp - 0x920], eax
sete al
mov esi, eax
test esi, esi
jne 0x421fc8
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call fcn.00427b40
add esp, 0xc
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push 0x40ef60
push dword [ebp - 0x91c]
mov dword [ebp - 0x928], 0x400
call edi
test eax, eax
jne 0x421fc8
lea eax, [ebp - 0x804]
push eax
call fcn.00422e89
mov esi, eax
neg esi
sbb esi, esi
pop ecx
neg esi
push dword [ebp - 0x91c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x421fea
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421fdd
jmp 0x422029
xor edi, edi
push 0x5c
push ebx
call fcn.0042380e
pop ecx
pop ecx
cmp eax, edi
je 0x422005
cmp word [eax + 2], di
jne 0x422005
xor ecx, ecx
mov word [eax], cx
push 0x5c
push ebx
call fcn.0042380e
pop ecx
pop ecx
cmp eax, edi
je 0x422019
xor ecx, ecx
mov word [eax + 2], cx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42201e
sub eax, edx
sar eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004224f9
leave
ret

Function at 0x4224f9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x461070]
jne 0x422503
repz ret
jmp fcn.00425124
Function at 0x422ca6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x422ccd
call fcn.00425441
mov dword [eax], esi
call fcn.00425429
push 0x16
pop esi
mov dword [eax], esi
call fcn.004253cd
mov eax, esi
jmp 0x422d22
test dword [ebp + 0xc], 0xfffffff9
jne 0x422cb3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x422cfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00425459
pop ecx
call fcn.00425429
mov eax, dword [eax]
jmp 0x422d22
test al, 0x10
jne 0x422d20
test al, 1
je 0x422d20
test byte [ebp + 0xc], 2
je 0x422d20
call fcn.00425441
mov dword [eax], 5
call fcn.00425429
mov dword [eax], 0xd
jmp 0x422cf1
xor eax, eax
pop esi
pop ebp
ret

Function at 0x423841
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x423869
call fcn.00425441
and dword [eax], 0
call fcn.00425429
mov dword [eax], 0x16
call fcn.004253cd
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423886
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00425459
pop ecx
jmp 0x423864
test byte [ebp + 0xc], 0x80
je 0x423891
and eax, 0xfffffffe
jmp 0x423894
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x423877
xor eax, eax
pop ebp
ret
Function at 0x428431
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004249cc
and dword [ebp - 0x14], 0
cmp dword [0x465f98], 0
mov dword [ebp - 0x18], eax
jne 0x4284e4
push 0x402464
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42858c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402458
push ebx
call edi
test eax, eax
je 0x42858c
mov esi, dword [fcn.004034f4]
push eax
call esi
push 0x402448
push ebx
mov dword [0x465f98], eax
call edi
push eax
call esi
push 0x402434
push ebx
mov dword [0x465f9c], eax
call edi
push eax
call esi
push 0x402418
push ebx
mov dword [0x465fa0], eax
call edi
push eax
call esi
mov dword [0x465fa8], eax
test eax, eax
je 0x4284e4
push 0x402400
push ebx
call edi
push eax
call esi
mov dword [0x465fa4], eax
mov eax, dword [0x465fa4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.004034f0]
cmp eax, ecx
je 0x42853d
cmp dword [0x465fa8], ecx
je 0x42853d
push eax
call esi
push dword [0x465fa8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42853d
test ebx, ebx
je 0x42853d
call edi
test eax, eax
je 0x428534
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x428534
test byte [ebp - 8], 1
jne 0x42853d
or dword [ebp + 0x10], 0x200000
jmp 0x428570
mov eax, dword [0x465f9c]
cmp eax, dword [ebp - 0x18]
je 0x428570
push eax
call esi
test eax, eax
je 0x428570
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x428570
mov eax, dword [0x465fa0]
cmp eax, dword [ebp - 0x18]
je 0x428570
push eax
call esi
test eax, eax
je 0x428570
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x465f98]
call esi
test eax, eax
je 0x42858c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42858e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004224f9
leave
ret
Function at 0x42d82d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x466038], 0
push esi
push edi
jne 0x42d79e
call fcn.0042d700
test eax, eax
je 0x42d7e3
mov eax, dword [0x466038]
cmp eax, 1
jne 0x42d7bf
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42d7e3
jmp 0x42d825
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x42d825
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42d7e7
xor eax, eax
jmp 0x42d825
mov eax, dword [esi]
push dword [0x466038]
call edi
mov edi, eax
test edi, edi
je 0x42d809
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x42d825
lea edi, [esi + 0xff0]
push esi
push dword [0x466038]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x42d80f
mov eax, esi
pop edi
pop esi
ret
jmp 0x42d78a

Function at 0x42ef29
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
test eax, eax
je 0x42f04a
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ef51
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00422e4e
and dword [ebp - 0x10], 0
mov ebx, eax
pop ecx
mov dword [ebp - 0xc], edi
test ebx, ebx
je 0x42efae
lea eax, [esi - 1]
push eax
push edi
push esi
push ebx
mov dword [ebp - 0x10], 1
call fcn.00423bd1
xor eax, eax
push esi
push ebx
mov word [ebx + esi*2 - 2], ax
call fcn.00447b0d
add esp, 0x18
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42efb4
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00422e4e
mov edi, eax
pop ecx
test edi, edi
je 0x42f01f
lea eax, [esi - 1]
push eax
push dword [ebp - 4]
push esi
push edi
call fcn.00423bd1
xor eax, eax
push esi
push edi
mov word [edi + esi*2 - 2], ax
call fcn.00447b0d
push dword [ebp - 0xc]
push edi
call fcn.004235e0
add esp, 0x20
test eax, eax
je 0x42f016
mov dword [ebp - 8], 1
push edi
call fcn.00422e5e
pop ecx
jmp 0x42f037
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004235e0
pop ecx
pop ecx
test eax, eax
je 0x42f037
mov dword [ebp - 8], 1
cmp dword [ebp - 0x10], 0
je 0x42f044
push ebx
call fcn.00422e5e
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42f5be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0042f503
movzx eax, word [esi + 4]
push 2
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esi + 0x234], eax
test eax, eax
jne 0x42f5f8
xor eax, eax
jmp 0x42f749
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 0x238], eax
test eax, eax
je 0x42f5f1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x23c], eax
test eax, eax
je 0x42f5f1
push dword [esi + 0x234]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + 0x240]
and dword [ecx], 0
push eax
push ecx
push dword [esi + 0x23c]
mov dword [esi + 0x244], eax
call fcn.004316c7
mov dword [esi + 0x220], eax
test eax, eax
je 0x42f5f1
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.0043150a
mov eax, dword [ebp - 0x28]
push dword [esi + 0x220]
mov dword [esi + 0x254], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x258], eax
call fcn.00431691
mov dword [esi + 0x214], eax
test eax, eax
je 0x42f5f1
push edi
push dword [esi + 0x220]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor edi, edi
inc edi
cmp word [eax + 0xe], 0x18
je 0x42f6b9
mov dword [esi + 0x228], edi
mov ecx, dword [eax]
xor edx, edx
add ecx, eax
cmp dword [eax + 0x20], edx
jle 0x42f6b9
mov word [ecx], dx
add ecx, 2
inc edx
cmp edx, dword [eax + 0x20]
jl 0x42f6ad
push dword [esi + 0x220]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 0x244]
mov dword [esi + 0x22c], edi
push dword [esi + 0x23c]
call fcn.00431ba0
cmp dword [ebp - 0x1c], 0
mov dword [esi + 0x218], eax
je 0x42f6ee
test eax, eax
jne 0x42f6f2
jmp 0x42f711
test eax, eax
je 0x42f746
cmp dword [esi + 0x230], 0
jne 0x42f746
push dword [esi + 0x214]
push eax
call fcn.00431990
mov dword [esi + 0x21c], eax
test eax, eax
jne 0x42f71c
mov ecx, esi
call fcn.0042f503
xor eax, eax
jmp 0x42f748
lea eax, [esi + 0x248]
push eax
push dword [esi + 0x250]
push dword [esi + 0x24c]
push dword [esi + 0x214]
push dword [esi + 0x218]
call fcn.004318d0
mov dword [esi + 0x224], eax
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004224f9
leave
ret

Function at 0x42f988
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp dword [ecx], 0
je 0x42f992
jmp fcn.0042f5be
jmp fcn.0042f75b
Function at 0x42faa5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0x403c78
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x42fb74
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
mov edi, 0x403c68
push edi
push dword [ebp - 8]
call esi
test eax, eax
jne 0x42fb72
cmp dword [ebp - 4], ebx
je 0x42fb72
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x42fb72
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 8]
call esi
test eax, eax
jne 0x42fb69
cmp dword [ebp - 0x10], 7
jne 0x42fb69
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 0x14]
cmp edi, ebx
jbe 0x42fb69
cmp byte [esi], bl
je 0x42fb69
lea eax, [ebp - 0xc]
push eax
push edi
push esi
call fcn.0042fa69
test eax, eax
js 0x42fb69
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x42fb62
inc dword [ebp - 0xc]
add esi, dword [ebp - 0xc]
sub edi, dword [ebp - 0xc]
jne 0x42fb34
jmp 0x42fb69
mov dword [ebp - 0x18], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
cmp dword [ebp - 8], ebx
pop ebx
je 0x42fb83
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x42fc7f
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0042fb8f
test eax, eax
je 0x42fdc7
push esi
xor eax, eax
push 0xc6
mov word [ebp - 0xcc], ax
xor esi, esi
lea eax, [ebp - 0xca]
push esi
push eax
call fcn.00427b40
mov eax, dword [ebp + 8]
add esp, 0xc
sub eax, esi
je 0x42fcd5
dec eax
jne 0x42fced
push 0x63
push 0x403d1c
jmp 0x42fcdc
push 0x63
push 0x403d00
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.00423bd1
add esp, 0x10
push edi
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00427b40
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xf4], eax
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x104], 0x440
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xf8], 0x403cf0
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0xec], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x42fdc5
cmp dword [ebp - 0xe8], 0x20
jle 0x42fdc5
cmp dword [ebp + 0xc], esi
je 0x42fdc5
cmp dword [ebp - 0xd0], esi
je 0x42fdc5
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push ebx
mov ebx, 0x4ff
jmp 0x42fda5
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x124]
push eax
call dword [0x4650f8]
push 1
push esi
push esi
push esi
lea eax, [ebp - 0x124]
push eax
call dword [0x46512c]
test eax, eax
jne 0x42fd75
push ebx
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0xd0]
push eax
push 1
call edi
test eax, eax
jne 0x42fd8f
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004224f9
leave
ret 8
Function at 0x430f85
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x36c
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x364]
push eax
mov dword [ebp - 0x364], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x430fbf
mov eax, 0xffff
jmp 0x4311da
cmp dword [ebp - 0x354], 2
push esi
je 0x43105c
xor eax, eax
push 0x3e
mov word [ebp - 0x44], ax
xor esi, esi
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.00427b40
add esp, 0xc
lea eax, [ebp - 0x368]
push eax
push 0x20019
push esi
push 0x4042c8
push SysReAllocStringLen
mov dword [ebp - 0x36c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431199
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push 0x40df5c
push dword [ebp - 0x368]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x368]
test eax, eax
jne 0x431193
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.00426a61
add esp, 0xc
movzx eax, ax
jmp 0x4311d9
mov eax, dword [ebp - 0x360]
fild dword [ebp - 0x360]
test eax, eax
jns 0x431072
fadd qword [0x40fd10]
fcomp qword [0x4042c0]
xor esi, esi
fnstsw ax
test ah, 1
jne 0x43112b
xor eax, eax
push 0x208
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x24e]
push esi
push eax
call fcn.00427b40
add esp, 0xc
push 0x104
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4042a0
push 0x20a
lea eax, [ebp - 0x250]
push eax
call fcn.00430ef6
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
je 0x431199
push 0x404284
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x431199
call eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp cx, 4
jne 0x4311d9
mov ecx, eax
and ecx, 0xfc00
mov edx, 0xc00
cmp cx, dx
jne 0x4311d9
mov eax, 0x404
jmp 0x4311d9
xor eax, eax
push 0x3e
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.00427b40
add esp, 0xc
lea eax, [ebp - 0x368]
push eax
push 0x20019
push esi
push 0x404238
push SysReAllocStringLen
mov dword [ebp - 0x36c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431199
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push 0x404224
push dword [ebp - 0x368]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x368]
test eax, eax
je 0x4311a0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffff
jmp 0x4311d9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.00426a61
movzx eax, ax
mov ecx, 0x401
add esp, 0xc
cmp cx, ax
je 0x4311d4
add ecx, 0xc
cmp cx, ax
je 0x4311d4
mov ecx, 0x41e
cmp cx, ax
jne 0x4311d9
mov eax, 0x409
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004224f9
leave
ret