joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104ba268
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104ba3b8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104ba28e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104ba27a
add dl, dl
jne 0x104ba299
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104ba2ec
xor eax, eax
add dl, dl
jne 0x104ba2a6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104ba38d
add dl, dl
jne 0x104ba2b5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104ba2c0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104ba2cb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104ba2d6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104ba2e2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104ba285
mov eax, 1
add dl, dl
jne 0x104ba2fa
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104ba305
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104ba2f1
sub eax, ebx
mov ebx, 1
jne 0x104ba338
mov ecx, 1
add dl, dl
jne 0x104ba31e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104ba329
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104ba315
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104ba285
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104ba34f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104ba35a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104ba346
cmp eax, 0x7d00
jae 0x104ba37d
cmp eax, 0x500
jb 0x104ba378
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104ba285
cmp eax, 0x7f
ja 0x104ba380
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104ba285
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104ba3ae
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104ba285
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42c550
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x25c]
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x25c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.0042c520
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0x25c]
mov dword [eax], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov edi, eax
mov esi, edx
lea ebx, [ebp - 8]
mov eax, ebx
call fcn.00403d00
push esi
push edi
mov edx, ebx
xor cx, cx
mov eax, 0xffffffff
call fcn.00409e00
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x5f4cd0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f4cd0]
mov eax, 0x617d90
call fcn.00423b60
push 0
mov eax, 0x621254
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24c], eax
lea edx, [ebp - 0x254]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.00408f50
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42c642
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42c670
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 0x25c]
mov dword [edx], eax
mov eax, dword [ebp - 0x258]
xor edx, edx
call fcn.00408bc0
jmp 0x42c72a
push 0xc
lea eax, [ebp - 0x24]
push eax
call fcn.00446a00
push 0x224
lea eax, [ebp - 0x248]
push eax
call fcn.00446a00
mov dword [ebp - 0x244], 0x224
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x244]
lea eax, [ebp - 0x248]
push eax
push 0xc
lea eax, [ebp - 0x24]
push eax
push 0x2d1400
push ebx
call sub.kernel32.dll_DeviceIoControl
or eax, eax
jne 0x42c6e0
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 0x25c]
mov dword [edx], eax
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x258]
xor edx, edx
call fcn.00408bc0
jmp 0x42c72a
cmp dword [ebp - 0x230], 0
je 0x42c702
lea eax, [ebp - 0x248]
add eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.00409510
jmp 0x42c70e
mov eax, dword [ebp - 0x25c]
mov dword [eax], 0xffffffff
cmp ebx, 0xffffffff
je 0x42c71c
push ebx
call sub.kernel32.dll_CloseHandle
lea esi, [esi]
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0x14]
call fcn.00408bc0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042c520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42cd40
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.0042cd20
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 8]
call fcn.0045fbc0
mov dword [ebp - 0xc], eax
xor eax, eax
push fcn.0042cd10
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x14]
call fcn.0045fbb0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00408bc0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0042cd10
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x5f4fe0
call sub.shell32.dll_SHGetKnownFolderPath
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.0040b430
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x14
call fcn.00408bc0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x14]
call fcn.0042cb50
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.00408bc0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 2
call fcn.00408f50
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x5f4d10]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f4d10]
mov eax, 0x617d90
call fcn.00423b60
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
call fcn.0042c360
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00408bc0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042cd20
mov esp, ebp
pop ebp
ret
Function at 0x439430
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
mov ebx, eax
mov esi, edx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00439420
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xc], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x43946a
mov eax, dword [eax - 4]
add eax, 1
test eax, eax
je 0x439478
mov byte [ebp - 8], 0
jmp 0x4394ee
mov byte [ebx + 4], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5f1920]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1920]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4394a8
mov eax, 0x6722f0
push eax
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateMutexA
test eax, eax
jbe 0x4394e8
mov byte [ebp - 0xc], 1
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x4394cc
mov byte [ebx + 4], 1
mov esi, esi
push dword [0x5f1b50]
mov edx, 0x620948
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
mov eax, dword [esi]
add eax, 0x3c
call fcn.0040d500
mov esi, esi
mov al, byte [ebp - 0xc]
mov byte [ebp - 8], al
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00439420
mov al, byte [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439960
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
xor eax, eax
push fcn.00439930
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov edx, dword [eax + 0x3c]
mov ecx, dword [0x5f1c30]
mov eax, dword [ebp - 0x3c]
call fcn.00438790
test al, al
jne 0x4399c4
mov byte [ebp - 0x34], 0
jmp 0x439b5a
mov byte [ebp - 0x40], 1
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x28]
push eax
mov edx, 0x622238
lea eax, [ebp - 0x24]
mov ecx, 1
call fcn.0040d060
mov ecx, 0x622200
mov edx, dword [0x5f1bf0]
mov eax, dword [ebp - 0x24]
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [0x5f1c00]
mov eax, dword [ebp - 0x24]
add eax, 4
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [0x5f1c10]
mov eax, dword [ebp - 0x24]
add eax, 8
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [0x5f1c20]
mov eax, dword [ebp - 0x24]
add eax, 0xc
call fcn.0040d040
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 0x2c]
cmp byte [eax + 0x10], 0
jne 0x439b1c
mov dword [ebp - 0x44], 0
push 0x80000000
push 0
push 0
call fcn.00554b30
mov edi, eax
test edi, edi
je 0x439b1c
mov eax, dword [ebp - 0x24]
call fcn.0040cf30
mov esi, eax
mov dword [ebp - 0x44], 0xffffffff
lea esi, [esi]
add dword [ebp - 0x44], 1
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov eax, dword [eax + edx*4]
call fcn.0040cf30
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov edx, dword [eax + edx*4]
mov eax, 0x617d90
call fcn.00423b60
push 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x439aba
mov eax, dword [eax - 4]
mov edx, eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x439ac8
mov eax, 0x6722f0
lea ecx, [ebp - 0x2c]
call fcn.00441760
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x439adc
mov eax, 0x6722f0
push eax
push edi
call fcn.00554b40
mov ebx, eax
test ebx, ebx
setne al
and eax, 0xff
neg eax
je 0x439b10
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.00554b50
test eax, eax
je 0x439b10
cmp dword [ebp - 0x18], 4
jne 0x439b19
mov byte [ebp - 0x40], 0
nop
jmp 0x439b19
cmp esi, dword [ebp - 0x44]
ja 0x439a80
lea esi, [esi]
mov al, byte [ebp - 0x40]
test al, al
je 0x439b54
mov ebx, 0x620948
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [0x5f1c40]
mov edx, dword [0x5f1c30]
mov eax, dword [ebp - 0x3c]
call fcn.004388c0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea eax, [ecx + 0x3c]
mov ecx, ebx
call fcn.0040d040
mov esi, esi
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x34], al
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00439930
mov al, byte [ebp - 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00439b80
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi]
mov edx, dword [eax + 0x3c]
mov ecx, dword [0x5f1c60]
mov eax, esi
call fcn.00438790
test al, al
jne 0x439c0c
mov byte [ebp - 0x20], 0
jmp 0x439d33
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0x10], 0
jne 0x439d04
lea eax, [ebp - 8]
push eax
mov eax, dword [0x5f1930]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1930]
mov eax, 0x617d90
call fcn.00423b60
call sub.kernel32.dll_GetCommandLineW
lea ecx, [ebp - 4]
xor dx, dx
call fcn.0040b430
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, 1
call fcn.00409a90
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x5f1c50]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1c50]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 1
call fcn.00409a90
add ebx, eax
test ebx, ebx
jbe 0x439c9d
mov eax, dword [esi + 0xc]
mov byte [eax + 5], 1
jmp 0x439d04
xor bl, bl
mov byte [ebp - 0x24], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
or eax, eax
je 0x439cf4
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x14
push dword [ebp - 0xc]
call sub.advapi32.dll_GetTokenInformation
or eax, eax
setne al
mov byte [ebp - 0x24], al
test al, al
je 0x439cf4
mov eax, dword [esi + 0xc]
cmp dword [ebp - 0x10], 0
seta byte [eax + 5]
lea esi, [esi]
cmp dword [ebp - 0xc], 0
jbe 0x439d04
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov esi, esi
mov ebx, 0x620948
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x5f1c70]
mov edx, dword [0x5f1c60]
mov eax, esi
call fcn.004388c0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi]
add eax, 0x3c
mov ecx, ebx
call fcn.0040d040
mov byte [ebp - 0x20], 1
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00439b80
mov al, byte [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a600
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xb0]
push ebx
push esi
push edi
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
xor eax, eax
push fcn.0043a5b0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [ebp - 0x9c], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0xa4]
call fcn.00403d00
push 0
push 1
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x80]
xor cx, cx
mov edx, 0x7f
call fcn.004095b0
mov esi, dword [ebp - 0xa8]
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f16c0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f16c0]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa4]
mov ecx, esi
call fcn.00408cc0
mov edx, dword [ebp - 0xa4]
lea ecx, [ebp - 0x98]
mov eax, 0x620a18
call fcn.004282c0
lea ecx, [ebp - 0x84]
lea edx, [ebp - 0x98]
mov eax, 0x620a18
call fcn.00428240
mov dword [ebp - 0xb0], 5
lea eax, [ebp - 0xb0]
push eax
mov edx, 0x6222a8
lea eax, [ebp - 0xa0]
mov ecx, 1
call fcn.0040d060
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d20]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d20]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d30]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d30]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 4
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d40]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d40]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 8
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d50]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d50]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 0xc
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d60]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d60]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 0x10
call fcn.00408bc0
lea eax, [ebp - 0x88]
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xa0]
call fcn.0040cf30
mov esi, eax
mov edi, 0xffffffff
lea esi, [esi]
nop
add edi, 1
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x84]
call fcn.00409780
test eax, eax
jne 0x43a888
mov eax, dword [0x5f5180]
or eax, ebx
mov ebx, eax
jmp 0x43a88c
cmp esi, edi
ja 0x43a860
test ebx, ebx
sete bl
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043a5b0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b030
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x234]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
xor eax, eax
push fcn.0043afd0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x234], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ebx, eax
test ebx, ebx
jbe 0x43b2b8
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x208]
mov cl, 1
mov edx, 0x103
call fcn.0040b930
mov eax, dword [ebp - 0x220]
mov ecx, ebx
xor edx, edx
call fcn.0040bd70
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x210]
call fcn.0040b370
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x214]
call fcn.0040a690
mov ecx, dword [ebp - 0x214]
mov eax, esi
mov edx, 0x6220c4
call fcn.0043af20
mov esi, eax
test esi, esi
jbe 0x43b20c
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x224], eax
lea edx, [esi + 2]
cmp word [eax + edx*2 - 2], 0x78
jne 0x43b163
mov eax, dword [ebp - 0x224]
lea edx, [esi + 3]
cmp word [eax + edx*2 - 2], 0x65
je 0x43b20c
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x5f1970]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1970]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.0040a5c0
mov ebx, dword [ebp - 0x228]
lea eax, [ebp - 0x230]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 0x214]
xor edx, edx
call fcn.0040ab80
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x214]
mov ecx, ebx
call fcn.0040a710
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x220]
call fcn.0040b3a0
mov ebx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x21c]
call fcn.0040b3a0
mov eax, dword [ebp - 0x21c]
mov edx, ebx
call fcn.004638d0
mov eax, dword [edi]
add eax, 0x24
mov edx, dword [ebp - 0x214]
call fcn.0040a690
lea eax, [ebp - 0x20c]
push eax
push 0
mov eax, edi
push eax
mov eax, 0x433280
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, 1
mov eax, 0x620f30
call fcn.0042a7e0
mov ebx, eax
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x5f1cf0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1cf0]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x218]
call fcn.0040a5c0
push 1
push 0
mov edx, dword [edi]
mov eax, ebx
call fcn.0042a8e0
push eax
mov eax, dword [ebp - 0x214]
test eax, eax
jne 0x43b289
mov eax, 0x6722f0
push eax
mov eax, dword [ebp - 0x218]
test eax, eax
jne 0x43b299
mov eax, 0x6722f0
push eax
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jbe 0x43b2b8
mov byte [ebp - 0x234], 1
mov eax, dword [edi]
push dword [eax + 0x34]
call sub.kernel32.dll_CloseHandle
nop
mov bl, byte [ebp - 0x234]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043afd0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x62ada8
lea eax, [ebp - 0x268]
call fcn.0040eef0
xor eax, eax
push fcn.00463570
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4635d3
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x46361b
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x4635ef
clc
jmp 0x4635f6
bt dword [0x62a310], eax
jb 0x46360f
mov eax, ebp
call fcn.004636c0
test al, al
je 0x46360f
mov byte [ebp - 0x26c], 1
jmp 0x4636a0
mov byte [ebp - 0x26c], 0
jmp 0x4636a0
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x5f5e40]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x4636a0
and esi, 0x400
je 0x4636a0
lea ebx, [ebp - 0x268]
mov edx, 0x62ada8
mov eax, ebx
call fcn.0040efb0
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.00463230
test eax, eax
je 0x463674
sub eax, 1
je 0x46368c
jmp 0x463698
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.00463590
mov byte [ebp - 0x26c], al
jmp 0x4636a0
mov byte [ebp - 0x26c], 1
jmp 0x4636a0
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00463570
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4638b0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x4638bc
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x463a00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.004639f0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x463a70
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.0040bbf0
cmp ebx, 1
jle 0x463a60
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.0040b280
jmp 0x463a7b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00408bc0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004639f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4646a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x673b60], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x6739c0], eax
mov eax, dword [ebp - 0x90]
mov dword [0x6739d0], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x6739e0], eax
mov eax, dword [ebp - 0x88]
mov dword [0x6739f0], eax
mov edx, 0x673a01
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.004037b0
lea eax, [ebp - 0x80]
call fcn.00404980
mov byte [0x673a00], al
mov eax, 0x62a3e0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x673b70], eax
test eax, eax
je 0x464740
mov eax, 0x62a3ec
push eax
push dword [0x673b70]
call sub.kernel32.dll_GetProcAddress
mov dword [0x673b60], eax
nop
cmp dword [0x6739d0], 6
jae 0x464754
mov dword [0x5f5700], 0
nop
cmp dword [0x6739d0], 6
jb 0x464770
cmp dword [0x6739e0], 1
jb 0x464770
mov dword [0x5f5710], 2
mov esp, ebp
pop ebp
ret