joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a410
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481150
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ad070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
test edi, edi
je 0x42a55f
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebx
test eax, eax
je 0x42a55f
call fcn.00402750
mov ecx, eax
test ecx, ecx
jne 0x42a468
push 0x80004005
call fcn.004027d0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
call fcn.0040b990
add eax, 8
push eax
call ebx
test eax, eax
je 0x42a49d
call fcn.0040b990
add eax, 8
lea ecx, [ebp - 0x14]
push eax
call fcn.004081c0
mov esi, dword [ebp - 0x14]
or ebx, 0xffffffff
cmp dword [esi - 0xc], 0
jle 0x42a52d
push edi
lea ecx, [ebp - 0x10]
call fcn.00407e20
mov byte [ebp - 4], 1
call fcn.0040b990
lea ecx, [eax + 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a4c5
sub ecx, edx
sar ecx, 1
je 0x42a4f3
push edi
call fcn.0040b990
add eax, 0x210
push eax
lea eax, [ebp - 0x10]
push str.__s__s_
push eax
call fcn.00406b20
add esp, 0x10
push 0
push 0
push dword [ebp - 0x10]
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42a526
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 1
jmp 0x42a52f
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x42a54b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4813ae
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4ad070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x5c]
push eax
call fcn.0042b840
mov dword [ebp - 4], 0
push dword [ebp - 0x5c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b3ea
and dword [ebp - 0x70], 0xfffffe00
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x78]
mov ecx, dword [ebp - 0x5c]
call fcn.0041ec60
mov eax, dword [ebp - 0x70]
test al, al
je 0x42b42c
cmp al, 7
je 0x42b42c
lea ecx, [ebp - 0x78]
call fcn.0041cc50
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x5c]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42b40e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045230d
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
push ecx
push str.send_date
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.0041d350
lea edx, [ebp - 0x68]
mov ecx, eax
call fcn.0042c700
mov eax, dword [ebp - 0x64]
mov edi, dword [ebp - 0x68]
sub eax, edi
sar eax, 2
cmp eax, 3
jb 0x42b4af
mov ecx, dword [edi]
cmp ecx, 0x7d0
jb 0x42b4af
mov eax, dword [edi + 4]
cmp eax, 1
jb 0x42b4af
cmp eax, 0xc
ja 0x42b4af
mov eax, dword [edi + 8]
cmp eax, 1
jb 0x42b4af
cmp eax, 0x1f
ja 0x42b4af
sub esp, 0x10
push eax
push dword [edi + 4]
push ecx
lea ecx, [ebp - 0x88]
call fcn.00427410
mov ecx, dword [eax]
mov dword [ebx + 0x3c], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x40], eax
lea ecx, [ebp - 0x80]
call fcn.004273f0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x80]
call fcn.0042d870
test eax, eax
je 0x42b4cc
mov esi, dword [eax + 0xc]
jmp 0x42b4ce
xor esi, esi
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebx + 0x3c]
call fcn.0042d870
test eax, eax
je 0x42b4e3
mov eax, dword [eax + 0xc]
jmp 0x42b4e5
xor eax, eax
cmp esi, eax
je 0x42b521
mov eax, dword [ebp - 0x80]
mov dword [ebx + 0x3c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebx + 0x40], eax
mov byte [ebp - 4], 4
lea ecx, [ebx + 0x34]
mov eax, dword [ebx + 0x34]
push dword [eax + 4]
call fcn.00412a10
mov eax, dword [ebx + 0x34]
mov dword [eax + 4], eax
mov eax, dword [ebx + 0x34]
mov dword [eax], eax
mov eax, dword [ebx + 0x34]
mov dword [eax + 8], eax
mov dword [ebx + 0x38], 0
jmp 0x42b539
push ecx
push str.reports
lea ecx, [ebp - 0x78]
call fcn.0041d350
lea edx, [ebx + 0x34]
mov ecx, eax
call fcn.0042c880
test edi, edi
je 0x42b54c
mov eax, dword [ebp - 0x60]
sub eax, edi
sar eax, 2
push eax
push edi
call fcn.00406f90
lea ecx, [ebp - 0x78]
call fcn.0041cc50
mov esi, 1
jmp 0x42b3ec
Function at 0x42c020
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e228
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x4ad070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00455270
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi + 0x44]
push 0x104
push eax
push 0x4992e4
push dword [ebp + 8]
push str.masterpdf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x2a
cmp ax, word [ebp - 0x218]
je 0x42c0d5
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x42c0b0
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.00408110
mov esi, 1
jmp 0x42c0d7
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42c0f9
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045230d
mov esp, ebp
pop ebp
ret 8

Function at 0x42d110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42d1af
push 0x2c
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00455270
add esp, 0xc
mov dword [esp + 8], 0x30
lea eax, [esp + 8]
mov dword [esp + 0x1c], 0x400000
mov dword [esp + 0x30], str.Q360SoftMgrTimerWnd
mov dword [esp + 0x10], 0x42d200
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42d1b9
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d8e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48171b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4ad070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x21c], edi
mov ebx, ecx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x22c], 0
call fcn.00402750
mov ecx, eax
test ecx, ecx
jne 0x42d93d
push 0x80004005
call fcn.004027d0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x220], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00455270
add esp, 0xc
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x42d9c8
push dword [ebp - 0x21c]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x42d9c8
add esi, 0xfffffff0
mov ecx, esi
call fcn.00407fe0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42dac3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x42dac3
lea eax, [ebp - 0x228]
mov dword [ebp - 0x21c], 0
push eax
push 4
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x228], 0
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x42da13
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x42da59
mov eax, dword [0x4b1540]
test eax, eax
jne 0x42da38
push str.QueryFullProcessImageNameW
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4b1540], eax
mov dword [ebp - 0x224], 0x104
test eax, eax
je 0x42da59
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42da70
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.00408110
mov esi, dword [ebp - 0x220]
add esi, 0xfffffff0
mov ecx, esi
call fcn.00407fe0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42dac3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045230d
mov esp, ebp
pop ebp
ret
Function at 0x42daf0
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48175b
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4ad070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x42dc33
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42dc33
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x42dc33
push 0x228
lea eax, [ebp - 0x23c]
push 0
push eax
call fcn.00455270
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42dc21
mov ecx, ebx
call fcn.00410330
nop
mov edx, dword [ebp - 0x238]
lea ecx, [ebp - 0x244]
call fcn.0042d8e0
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00431340
test eax, eax
je 0x42dbe6
lea edx, [ebp - 0x244]
mov ecx, edi
call fcn.00431340
test eax, eax
je 0x42dbe6
push dword [ebp - 0x244]
lea eax, [ebp - 0x238]
push eax
push ecx
lea eax, [ebp - 0x24c]
mov ecx, ebx
push eax
call fcn.0042dc60
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42dc0b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x240]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42db90
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, dword [ebx + 4]
sbb eax, eax
neg eax
jmp 0x42dc35
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045230d
mov esp, ebp
pop ebp
ret
Function at 0x42f120
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4819b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4ad070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x42f2d4
push 0x4afc94
push 0x100
call fcn.0045289a
xor ebx, ebx
mov dword [ebp - 0x34], vtable.CxAutoArray_unsigned_char_.0
add esp, 8
mov dword [ebp - 0x30], ebx
test eax, eax
je 0x42f186
mov ebx, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
je 0x42f19b
mov esi, dword [edi + 4]
sub esi, dword [edi]
jmp 0x42f19d
xor esi, esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0
call fcn.0041a5e0
mov ecx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
jne 0x42f1bc
test eax, eax
je 0x42f1c8
test edi, edi
je 0x42f1c8
push eax
mov ecx, edi
call fcn.00411c30
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push 0x100
push ebx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42f2aa
mov edx, dword [ebp + 0xc]
nop
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x42f2cd
test edi, edi
je 0x42f24d
mov edx, dword [edi + 4]
xor eax, eax
sub edx, dword [edi]
mov dword [ebp - 0x18], ecx
add dword [ebp - 0x18], esi
adc eax, dword [ebp - 0x1c]
test eax, eax
jb 0x42f238
ja 0x42f22a
cmp dword [ebp - 0x18], edx
jbe 0x42f238
lea eax, [esi + ecx]
mov ecx, edi
push eax
call fcn.00411c30
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi]
push ecx
add eax, esi
push ebx
push eax
call fcn.00455810
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
add esi, ecx
adc eax, 0
mov dword [ebp - 0x1c], eax
test edx, edx
je 0x42f279
push ecx
push eax
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x28]
call edx
add esp, 0x24
test eax, eax
je 0x42f2aa
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push 0x100
push ebx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [ebp + 0xc]
test eax, eax
jne 0x42f200
xor esi, esi
test ebx, ebx
je 0x42f2b9
push ebx
call fcn.004529f8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 1
jmp 0x42f2ac
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f2f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48198e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ad070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
test edi, edi
je 0x42f3ef
test esi, esi
je 0x42f3ef
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.0042ef60
test eax, eax
je 0x42f3aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
setne al
test al, al
je 0x42f3aa
mov ecx, ebx
call fcn.0041a470
mov ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
cmp edx, 3
je 0x42f382
cmp edx, 4
je 0x42f3aa
cmp edx, 5
je 0x42f3aa
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42f392
lea eax, [ebp - 0x18]
push eax
call fcn.00420690
sub esp, 8
mov edx, ebx
push dword [ebp + 0xc]
push ecx
push esi
mov ecx, edi
call fcn.0042f410
add esp, 0x14
mov ebx, eax
jmp 0x42f3ac
xor ebx, ebx
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x42f3db
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x42f3db
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x42f3db
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fc30
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], vtable.MD5_CTX.0
xorps xmm0, xmm0
mov dword [ecx + 0x18], 0
mov eax, ecx
mov dword [ecx + 0x14], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
movups xmmword [ecx + 0x5c], xmm0
movups xmmword [ecx + 0x6c], xmm0
movups xmmword [ecx + 0x7c], xmm0
movups xmmword [ecx + 0x8c], xmm0
mov byte [ecx + 0x5c], 0x80
ret

Function at 0x42fd80
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ad070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x42fda0
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x38
and edx, 0x3f
mov eax, 0x78
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovb eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.0042fcb0
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0042fcb0
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x42fe10
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movups xmmword [ebx], xmm0
pop edi
movups xmmword [ebx + 0x10], xmm0
pop esi
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.0045230d
mov esp, ebp
pop ebp
ret 4
Function at 0x431440
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481d90
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4ad070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x18], edi
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], 0
call fcn.00402750
mov ecx, eax
test ecx, ecx
jne 0x43148e
push 0x80004005
call fcn.004027d0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x14], eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
mov ecx, dword [edi]
cmp dword [ecx - 0xc], 0
je 0x4315b6
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4315b3
push 0x499a94
lea ecx, [ebp - 0x10]
call fcn.004101f0
mov byte [ebp - 4], 1
push 0
push dword [edi]
mov dword [ebp - 0x1c], 0x34
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43159e
push eax
call fcn.004529fd
mov edi, eax
add esp, 4
test edi, edi
jne 0x43153e
push 0x4994f4
mov ecx, ebx
call fcn.00407e20
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x431527
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jmp 0x4315d7
mov eax, dword [ebp - 0x18]
push edi
push dword [ebp - 0x14]
push 0
push dword [eax]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x431593
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x49be24
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x431593
mov ecx, dword [ebp - 0x20]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x10]
push 0x49ddd4
push eax
call fcn.00406b20
add esp, 0x18
push 1
push edi
call fcn.004529ea
add esp, 8
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
mov dword [ebx], eax
jmp 0x431506
mov eax, dword [ebp - 0x14]
mov ecx, eax
call fcn.00407fe0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4315e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4364e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d936
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ad070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004527fe
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004514f1
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x439d20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov eax, edi
mov dword [ebp - 4], eax
test edx, edx
je 0x439d6f
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x439d85
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x439d69
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x439d93
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret