joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4224b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5005dd
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.LauncherPatcher.exe
lea ecx, [ebp - 0x28]
call fcn.00408cc0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.0042cc10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
push ecx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0042f360
add esp, 0x10
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 3
cmp ecx, 0xf
jbe 0x422548
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42253e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4226e9
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
cmp ecx, 0xf
jbe 0x422592
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x422588
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4226e9
push ecx
push edx
call fcn.004cefc9
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov ecx, esp
mov dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x58]
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x74], ecx
push eax
call fcn.00408c10
mov ecx, esi
call fcn.004187c0
test al, al
jne 0x4225d2
mov ecx, dword [0x561b54]
push 6
call fcn.00421910
jmp 0x42269f
xorps xmm0, xmm0
mov dword [ebp - 0xc8], 0x44
lea eax, [ebp - 0x58]
movlpd qword [ebp - 0xc4], xmm0
push eax
lea eax, [ebp - 0x70]
movlpd qword [ebp - 0xbc], xmm0
push eax
movlpd qword [ebp - 0xb4], xmm0
movlpd qword [ebp - 0xac], xmm0
movlpd qword [ebp - 0xa4], xmm0
movlpd qword [ebp - 0x9c], xmm0
movlpd qword [ebp - 0x94], xmm0
movlpd qword [ebp - 0x8c], xmm0
movups xmmword [ebp - 0x84], xmm0
call fcn.0042c4a0
add esp, 8
cmp dword [eax + 0x14], 7
jbe 0x42263e
mov eax, dword [eax]
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0xc8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00415930
test esi, esi
jne 0x42267e
mov ecx, dword [0x561b54]
push 7
call fcn.00421910
jmp 0x42269f
push 0xffffffffffffffff
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x84]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x80]
call esi
mov ecx, dword [ebp - 0x44]
cmp ecx, 0xf
jbe 0x4226cf
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4226c5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4226ee
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
call fcn.004d529e
call fcn.004d529e
int3
Function at 0x423540
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50077d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0042c4a0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0042c4a0
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
cmp dword [ebp - 0x2c], 7
lea ecx, [ebp - 0x40]
push 0
cmova ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
push 0
cmova eax, dword [ebp - 0x28]
push ecx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov ecx, dword [ebp - 0x2c]
test eax, eax
sete bl
cmp ecx, 7
jbe 0x423605
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4235fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4236f7
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp ecx, 7
jbe 0x423653
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x423649
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4236f7
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 0xf
jbe 0x423697
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42368d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4236f7
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0xf
jbe 0x4236d9
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4236cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4236f7
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret 0x30
call fcn.004d529e
int3
Function at 0x42b260
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.004cf940
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x50663c
push eax
mov esi, ecx
call fcn.0042c280
mov edi, eax
add esp, 8
test edi, edi
je 0x42b336
push edi
push 0x10000
lea eax, [ebp - 0x10004]
mov dword [esi + 0x10], 0
push 1
push eax
mov dword [esi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.004e1f97
add esp, 0x10
test eax, eax
je 0x42b30a
nop
push eax
lea eax, [ebp - 0x10004]
mov ecx, esi
push eax
call fcn.004314c0
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.004e1f97
add esp, 0x10
test eax, eax
jne 0x42b2e0
mov ecx, esi
call fcn.0042c040
push edi
call fcn.004df996
movups xmm0, xmmword [esi + 0x58]
add esp, 4
mov al, 1
movups xmmword [ebx], xmm0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cefd7
mov esp, ebp
pop ebp
ret 8

Function at 0x42b450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
jbe 0x42b45e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42b46e
xor al, al
pop ebp
ret
shr eax, 4
and al, 1
pop ebp
ret

Function at 0x42b6e0
Capabilities:
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.004cf940
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
je 0x42b725
push esi
call fcn.0042e3d0
add esp, 4
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x42b719
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [edi + 0x14], 0xf
jbe 0x42b72d
mov edi, dword [edi]
push 0x50663c
push edi
call fcn.0042c280
mov edi, eax
add esp, 8
test edi, edi
je 0x42b766
cmp dword [esi + 0x14], 0xf
jbe 0x42b749
mov esi, dword [esi]
push 0x5089ec
push esi
call fcn.0042c280
add esp, 8
mov esi, eax
push edi
test esi, esi
jne 0x42b779
call fcn.004df996
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.004e1f97
add esp, 0x10
test eax, eax
je 0x42b7be
push esi
push eax
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.004e2d8d
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.004e1f97
add esp, 0x20
test eax, eax
jne 0x42b793
push edi
call fcn.004df996
push esi
call fcn.004df996
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
Function at 0x42b7e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50097d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x42b829
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x42b81d
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x14], 0xf
jbe 0x42b831
mov esi, dword [esi]
test esi, esi
mov dword [ebp - 0x18], 0
mov edx, 0x504683
mov dword [ebp - 0x14], 0
cmovne edx, esi
xorps xmm0, xmm0
mov ecx, edx
movups xmmword [ebp - 0x28], xmm0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42b855
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00413600
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0042c4a0
add esp, 8
cmp dword [eax + 0x14], 7
jbe 0x42b887
mov eax, dword [eax]
push eax
call fcn.004e1d96
mov ecx, dword [ebp - 0x2c]
add esp, 4
mov esi, eax
cmp ecx, 7
jbe 0x42b8c8
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42b8be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42b92c
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp ecx, 0xf
jbe 0x42b90c
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42b902
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42b92c
push ecx
push edx
call fcn.004cefc9
add esp, 8
test esi, esi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
call fcn.004d529e
int3

Function at 0x42b940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
jbe 0x42b94e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42b95e
xor al, al
pop ebp
ret
shr eax, 4
not al
and al, 1
pop ebp
ret
Function at 0x42bbb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp eax, dword [edi + 4]
je 0x42bbc3
mov dword [edi + 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
jbe 0x42bbce
mov eax, dword [eax]
push 0x50663c
push eax
call fcn.0042c280
mov ebx, eax
add esp, 8
mov dword [ebp + 8], ebx
test ebx, ebx
jne 0x42bbec
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
push 2
push 0
push ebx
call fcn.004e2374
push ebx
call fcn.004e2a98
mov esi, dword [ebp + 0x14]
mov ebx, eax
cmp ebx, esi
push 0
cmovl esi, ebx
push esi
push dword [ebp + 8]
call fcn.004e2374
sub ebx, esi
add esp, 0x1c
xor esi, esi
test ebx, ebx
jle 0x42bd2f
movsd xmm0, qword [0x508a40]
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
comisd xmm0, xmm1
jbe 0x42bd2f
cmp dword [ebp + 0x10], ebx
mov edx, dword [edi + 8]
cmovl ebx, dword [ebp + 0x10]
mov ecx, dword [edi]
sub edx, ecx
cmp ebx, edx
jbe 0x42bcd7
cmp ebx, 0x7fffffff
ja 0x42bd44
mov esi, edx
mov eax, closesocket
shr esi, 1
sub eax, esi
cmp edx, eax
jbe 0x42bc72
mov esi, closesocket
jmp 0x42bc79
add esi, edx
cmp esi, ebx
cmovb esi, ebx
test ecx, ecx
je 0x42bcbd
cmp edx, 0x1000
jb 0x42bc9f
mov eax, dword [ecx - 4]
add edx, 0x23
sub ecx, eax
mov dword [ebp + 0xc], eax
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x42bd49
mov ecx, dword [ebp + 0xc]
push edx
push ecx
call fcn.004cefc9
mov dword [edi], 0
add esp, 8
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push esi
mov ecx, edi
call fcn.00431ee0
mov esi, dword [edi]
push ebx
push 0
push esi
call fcn.004d1bb0
add esp, 0xc
add esi, ebx
jmp 0x42bd15
mov esi, dword [edi + 4]
sub esi, ecx
cmp ebx, esi
jbe 0x42bd06
push esi
push 0
push ecx
call fcn.004d1bb0
mov edi, ebx
sub edi, esi
mov esi, dword [ebp + 0xc]
push edi
push 0
mov esi, dword [esi + 4]
push esi
call fcn.004d1bb0
add esp, 0x18
add esi, edi
mov edi, dword [ebp + 0xc]
jmp 0x42bd15
push ebx
push 0
push ecx
lea esi, [ebx + ecx]
call fcn.004d1bb0
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [edi]
sub esi, eax
je 0x42bd4e
push dword [ebp + 8]
push ebx
push 1
push eax
call fcn.004e1f97
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
call fcn.004df996
add esp, 4
cmp esi, ebx
sete al
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.0040df90
call fcn.004d529e
call fcn.0041a270
int3
Function at 0x42bd60
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500fbd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.0042c4a0
add esp, 8
mov esi, eax
cmp dword [esi + 0x14], 7
mov dword [ebp - 4], 0
jbe 0x42bdb5
mov esi, dword [esi]
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.0042c4a0
add esp, 8
cmp dword [eax + 0x14], 7
jbe 0x42bdca
mov eax, dword [eax]
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp ecx, 7
jbe 0x42be10
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42be06
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42beef
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
cmp ecx, 7
jbe 0x42be65
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42be5b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42beef
push ecx
push edx
call fcn.004cefc9
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
test esi, esi
jne 0x42bec4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 5
jne 0x42bee2
cmp dword [edi + 0x14], 0xf
mov eax, edi
jbe 0x42be94
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42bea9
shr eax, 4
not al
test al, 1
jne 0x42bee2
push 1
push edi
push ebx
call fcn.0042b6e0
add esp, 0xc
test al, al
je 0x42bee2
push 1
push ebx
call fcn.0042b7e0
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x42beeb
mov dword [eax], esi
xor al, al
jmp 0x42bec6
call fcn.004d529e
int3

Function at 0x42bf40
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
push esi
mov esi, dword [ebp + 8]
push edi
je 0x42bf6d
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x42bf58
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.0042e3d0
add esp, 4
cmp dword [esi + 0x14], 0xf
jbe 0x42bf75
mov esi, dword [esi]
push 0x5089ec
push esi
call fcn.0042c280
mov esi, eax
add esp, 8
test esi, esi
jne 0x42bf8f
pop edi
xor al, al
pop esi
pop ebp
ret
mov edi, dword [ebp + 0x10]
push ebx
mov bl, 1
test edi, edi
je 0x42bfad
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.004e2d8d
add esp, 0x10
cmp eax, edi
sete bl
push esi
call fcn.004df996
add esp, 4
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x42c120
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x140]
push edi
push 0x124
push 0
push eax
call fcn.004d1bb0
add esp, 0xc
mov dword [ebp - 0x144], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x42c17a
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x144]
push eax
push edi
call sub.KERNEL32.dll_Process32First
push esi
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x120]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x1c], xmm0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42c1b0
sub eax, edx
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00413600
cmp dword [ebp - 8], 0xf
lea ecx, [ebp - 0x1c]
mov eax, ebx
cmova ecx, dword [ebp - 0x1c]
cmp dword [ebx + 0x14], 0xf
jbe 0x42c1de
mov eax, dword [ebx]
push ecx
push eax
call fcn.004e12f5
mov ecx, dword [ebp - 8]
add esp, 8
mov esi, eax
cmp ecx, 0xf
jbe 0x42c21a
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42c210
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42c26b
push ecx
push edx
call fcn.004cefc9
add esp, 8
test esi, esi
je 0x42c24d
lea eax, [ebp - 0x144]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x42c190
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x13c]
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
call fcn.004d529e
int3

Function at 0x42d430
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov edi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.004d1bb0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42d4a9
nop dword [eax]
cmp dword [ebp - 0x228], edi
je 0x42d4c2
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42d490
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
pop edi
pop esi
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
Function at 0x42daf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501356
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x24c], esi
call fcn.004d1bb0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push 0x7e
push eax
call fcn.004d1f1b
lea ecx, [ebp - 0x218]
add esp, 8
mov edx, eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42db75
sub ecx, edi
mov dword [ebp - 0x220], 0
sar ecx, 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x230]
movups xmmword [ebp - 0x230], xmm0
push eax
test edx, edx
je 0x42dc6e
call fcn.0042a890
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00430aa0
push eax
push esi
mov byte [ebp - 4], 1
call fcn.0042de90
mov ecx, dword [ebp - 0x234]
add esp, 0x10
cmp ecx, 0xf
jbe 0x42dc1f
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42dc15
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42dcb3
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x42dc96
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42dc8c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42dcb3
jmp 0x42dc8c
call fcn.0042a890
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.00430aa0
add esp, 8
jmp 0x42dc3a
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
call fcn.004d529e
int3
Function at 0x42dcc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501356
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x24c], esi
call fcn.004d1bb0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push 0x7e
push eax
call fcn.004d1f1b
lea ecx, [ebp - 0x218]
add esp, 8
mov edx, eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42dd45
sub ecx, edi
mov dword [ebp - 0x220], 0
sar ecx, 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x230]
movups xmmword [ebp - 0x230], xmm0
push eax
test edx, edx
je 0x42de3e
call fcn.0042a890
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00430aa0
push eax
push esi
mov byte [ebp - 4], 1
call fcn.0042de90
mov ecx, dword [ebp - 0x234]
add esp, 0x10
cmp ecx, 0xf
jbe 0x42ddef
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42dde5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42de83
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x42de66
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42de5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42de83
jmp 0x42de5c
call fcn.0042a890
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.00430aa0
add esp, 8
jmp 0x42de0a
push ecx
push edx
call fcn.004cefc9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
call fcn.004d529e
int3