joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bad5
Capabilities:
Delete file

Disassembly:
push 0x6c
mov eax, 0x4455ab
call fcn.0043fe00
mov esi, ecx
lea edi, [esi + 0x150]
push str.Bootstrapper::forceMFCStudioCleanup___deleteCurVersionKeys
push edi
call fcn.00402357
pop ecx
pop ecx
lea ecx, [ebp - 0x74]
call fcn.00433aa1
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
jb 0x42bb0b
mov eax, dword [eax]
mov dl, byte [esi + 0x4d]
push eax
mov ecx, edi
call fcn.0043366c
or dword [ebp - 4], 0xffffffff
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.0040253d
mov ecx, esi
call fcn.0042bc38
mov al, byte [esi + 0x4d]
mov byte [ebp - 0x78], al
push dword [ebp - 0x78]
lea eax, [ebp - 0x5c]
push eax
call fcn.004266f4
xor esi, esi
inc esi
mov dword [ebp - 4], esi
xor eax, eax
push str.RobloxStudioLauncher.exe
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x44], ax
call fcn.0040c0fb
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0042e19a
pop ecx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push str.Bootstrapper::forceMFCStudioCleanup___deleting_studio_stub:__S
push edi
call fcn.00402357
add esp, 0xc
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
call fcn.004355b5
test al, al
je 0x42bbba
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040253d
push ebx
push esi
lea ecx, [ebp - 0x44]
call fcn.0040253d
push ebx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040253d
call fcn.0043fdaf
ret

Function at 0x43043c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, 0x270
cmp dword [esi], edi
jne 0x430482
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
shr ecx, 1
xor eax, ecx
mov dword [edx + 0x9b8], eax
dec edi
jne 0x43044c
jmp 0x43048f
cmp dword [esi], 0x4e0
jb 0x43048f
call fcn.004304c8
mov eax, dword [esi]
inc eax
mov edx, dword [esi + eax*4]
mov dword [esi], eax
mov eax, dword [esi + 0x1384]
mov ecx, edx
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x4304c8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x9c4]
mov ebx, 0xe3
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
shr ecx, 1
xor eax, ecx
mov dword [edi - 0x9c4], eax
dec ebx
jne 0x4304d8
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
shr ecx, 1
xor eax, ecx
mov dword [edi - 0x9c4], eax
dec ebx
jne 0x430516
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
pop edi
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
shr ecx, 1
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x43222b
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.00432168
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x43224b
mov eax, dword [edi]
jmp 0x43224d
mov eax, edi
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4322dd
push eax
call fcn.0043ca16
mov dword [esi + 4], eax
cmp dword [edi + 0x14], 8
pop ecx
jb 0x432271
mov edi, dword [edi]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4322dd
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x10]
push eax
push 0x44ac5c
push dword [esi + 4]
mov dword [ebp + 8], ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4322dd
lea eax, [ebp + 8]
push eax
lea edi, [esi + 8]
push edi
push str.VarFileInfoTranslation
push dword [esi + 4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4322d8
mov eax, dword [ebp + 8]
cmp eax, 4
jb 0x4322d8
mov ecx, dword [edi]
shr eax, 2
mov dword [esi + 0xc], eax
mov ax, word [ecx]
mov word [esi], ax
mov ax, word [ecx + 2]
mov word [esi + 2], ax
xor ebx, ebx
inc ebx
jmp 0x4322ef
cmp dword [esi + 4], ebx
je 0x4322ef
push dword [esi + 4]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
pop ecx
mov dword [esi + 4], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x4330b6
Capabilities:
Delete registry key

Disassembly:
push 0x28
mov eax, 0x44675f
call fcn.0043fe00
mov edi, edx
mov dword [ebp - 0x30], ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4330f7
mov dword [ebp - 0x30], str.Attempt_to_delete_a_null_key
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x45a8b4
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::runtime_error.0
call sub.MSVCR110.dll__CxxThrowException
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040b345
cmp dword [eax + 0x10], 0
push 0
push 1
lea ecx, [ebp - 0x2c]
sete bl
call fcn.0040253d
test bl, bl
je 0x433120
mov dword [ebp - 0x30], str.Attempt_to_delete_an_empty_key
jmp 0x4330d5
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jns 0x433153
lea ecx, [ebp - 0x34]
call fcn.00432ea9
and dword [ebp - 4], 0
push dword [eax]
push esi
push str.Failed_to_delete_key__S__S
push dword [ebp - 0x30]
call fcn.00402357
add esp, 0x10
lea ecx, [ebp - 0x34]
call fcn.00402409
call fcn.0043fdaf
ret

Function at 0x43366c
Capabilities:
Delete registry value

Disassembly:
push 0x30
mov eax, 0x4469a3
call fcn.0043fe00
mov bl, dl
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
push str.deleteCurVersionKeys
push edi
mov dword [ebp - 4], eax
call fcn.00402357
xor eax, eax
pop ecx
test bl, bl
sete al
pop ecx
push 0x20006
push str.SoftwareROBLOX_CorporationBloxd
lea ecx, [ebp - 0x3c]
add eax, 0x80000001
push eax
call fcn.0040e1f5
mov esi, dword [ebp - 0x3c]
test eax, eax
js 0x43371d
push str.deleteCurVersionKeys___key_Opened
push edi
call fcn.00402357
mov ebx, dword [ebp - 0x30]
pop ecx
pop ecx
mov edx, ebx
lea ecx, [ebp - 0x2c]
call fcn.00433534
cmp dword [eax + 0x14], 8
jb 0x4336e5
mov eax, dword [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
push esi
call edi
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040253d
mov edx, ebx
lea ecx, [ebp - 0x2c]
call fcn.004335d0
cmp dword [eax + 0x14], 8
jb 0x43370d
mov eax, dword [eax]
push eax
push esi
call edi
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040253d
test esi, esi
je 0x433728
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0043fdaf
ret
Function at 0x43470f
Capabilities:
Delete file

Disassembly:
push 0x24
mov eax, 0x4469d8
call fcn.0043fe00
mov edi, edx
mov esi, ecx
push edi
push str.deleteDesktopShortcut____S
push esi
call fcn.00402357
xor ebx, ebx
push ebx
push ebx
push ebx
push 6
pop edx
lea ecx, [ebp - 0x2c]
call fcn.004350cd
add esp, 0x18
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], ebx
je 0x4347ac
push section..data
lea ecx, [ebp - 0x30]
call fcn.004023e0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push edi
push eax
lea eax, [ebp - 0x30]
push str._s_s.lnk
push eax
call fcn.0042d9ed
mov ecx, dword [ebp - 0x30]
add esp, 0x10
call fcn.004355b5
test al, al
je 0x4347a4
push dword [ebp - 0x30]
push str.deleteDesktopShortcut____S
push esi
call fcn.00402357
add esp, 0xc
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
lea ecx, [ebp - 0x30]
call fcn.00402409
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040253d
mov al, bl
call fcn.0043fdaf
ret

Function at 0x4347c0
Capabilities:
Delete file

Disassembly:
push 0x20
mov eax, 0x446a0d
call fcn.0043fe00
mov bl, dl
mov esi, ecx
mov edi, dword [ebp + 8]
push edi
push str.deleteProgramsShortcut____S
push esi
call fcn.00402357
xor edx, edx
test bl, bl
sete dl
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
add edx, 3
call fcn.004350cd
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x434861
push section..data
lea ecx, [ebp - 0x2c]
call fcn.004023e0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
lea eax, [ebp - 0x2c]
push str._s_s.lnk
push eax
call fcn.0042d9ed
mov ecx, dword [ebp - 0x2c]
add esp, 0x10
call fcn.004355b5
test al, al
je 0x434859
push dword [ebp - 0x2c]
push str.deleteProgramsShortcut____S
push esi
call fcn.00402357
add esp, 0xc
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x2c]
call fcn.00402409
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040253d
call fcn.0043fdaf
ret
Function at 0x434d1f
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28a0
call fcn.0043fd70
mov eax, dword [0x467034]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x28a0], 0
push esi
push edi
lea eax, [ebp - 0x289c]
push eax
lea eax, [ebp - 0x2888]
push eax
mov esi, ecx
mov dword [ebp - 0x289c], 0x2880
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea ecx, [ebp - 0x2888]
mov eax, dword [ecx + 0x1a0]
cmp eax, 6
je 0x434daf
cmp eax, 0x47
je 0x434daf
mov ecx, dword [ecx]
test ecx, ecx
jne 0x434d65
and dword [ebp - 0x2898], ecx
xor eax, eax
lea edi, [ebp - 0x2894]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2898]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push dword [ebp - 0x2898]
push str._08X
push esi
call fcn.0040f360
add esp, 0xc
jmp 0x434dfd
movzx eax, byte [ecx + 0x19b]
push eax
movzx eax, byte [ecx + 0x19a]
push eax
movzx eax, byte [ecx + 0x199]
push eax
movzx eax, byte [ecx + 0x198]
push eax
movzx eax, byte [ecx + 0x197]
push eax
movzx eax, byte [ecx + 0x196]
push eax
movzx eax, byte [ecx + 0x195]
push eax
movzx eax, byte [ecx + 0x194]
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
push esi
call fcn.0040f360
add esp, 0x28
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043ca4a
leave
ret
Function at 0x436b77
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x20
mov eax, 0x446f80
call fcn.0043fe36
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0x10]
and dword [ebp - 4], 0
push 8
pop esi
cmp dword [edi + 0x14], esi
jb 0x436b9b
mov eax, dword [edi]
jmp 0x436b9d
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436c02
cmp dword [edi + 0x14], esi
jb 0x436bb1
mov eax, dword [edi]
jmp 0x436bb3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x436c02
lea ecx, [ebp - 0x18]
call fcn.00432ea9
mov byte [ebp - 4], 1
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp dword [edi + 0x14], esi
jb 0x436bdd
mov edi, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebp - 0x14]
push edi
push str.Failed_to_delete_fileName__S_:__S
push eax
call fcn.00402357
add esp, 0x10
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00402409
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x14], esi
jb 0x436c0e
mov eax, dword [edi]
jmp 0x436c10
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436c75
cmp dword [edi + 0x14], esi
jb 0x436c24
mov eax, dword [edi]
jmp 0x436c26
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x436c75
lea ecx, [ebp - 0x14]
call fcn.00432ea9
mov byte [ebp - 4], 2
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [edi + 0x14], esi
jb 0x436c50
mov edi, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebp - 0x18]
push edi
push str.Failed_to_delete_path__S_:__S
push eax
call fcn.00402357
add esp, 0x10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00402409
xor edx, edx
cmp byte [ebx + 4], dl
push ecx
sete dl
push 0
push str.SoftwareRobloxRegETags
lea ecx, [ebp - 0x28]
add edx, 0x80000001
call fcn.00432fe5
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x14], esi
jb 0x436ca0
mov eax, dword [eax]
push 1
push 0x449168
push eax
lea ecx, [ebp - 0x28]
call fcn.0040e001
cmp dword [ebp - 0x28], 0
je 0x436cbf
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0043fd9b
ret 0xc

Function at 0x437675
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov edi, ecx
push 0
push dword [edi + 0x48]
mov byte [edi + 0x30], 1
call esi
push 0
push dword [edi + 0x40]
call esi
push 0
push dword [edi + 0x44]
call esi
push 0x4374e8
push 0x12c
push 1
push dword [edi + 0x58]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
ret
Function at 0x4379b7
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x24
mov eax, 0x447289
call fcn.0043fe6c
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x30], esi
mov byte [esi], bl
push str.Failed_CryptAcquireContext
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0040221e
push 0xf0000000
push 1
push ebx
push ebx
lea edi, [esi + 0x18]
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x437a09
lea ecx, [ebp - 0x2c]
call fcn.00432e82
lea ecx, [ebp - 0x2c]
call fcn.00402286
push str.Failed_CryptCreateHash
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0040221e
lea eax, [esi + 0x1c]
push eax
push ebx
push ebx
push 0x8003
mov byte [ebp - 4], 3
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x437a45
lea ecx, [ebp - 0x2c]
call fcn.00432e82
lea ecx, [ebp - 0x2c]
call fcn.00402286
mov eax, esi
call fcn.0043fdbe
ret

Function at 0x437a8b
Capabilities:
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4472b9
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x467034]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push esi
push edi
mov eax, dword [0x467034]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [edi]
push esi
mov ecx, dword [eax + 4]
push esi
add ecx, edi
call dword [sym.imp.MSVCP110.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool_]
push esi
push esi
push esi
mov ecx, edi
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
push esi
push 0x400
lea eax, [esp + 0x3c]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP110.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
mov eax, dword [edi + 0xc]
mov esi, dword [edi + 8]
push str.Failed_CryptHashData
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call fcn.0040221e
and dword [esp + 0x448], 0
push 0
push esi
lea eax, [esp + 0x3c]
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x437b3d
lea ecx, [esp + 0x1c]
call fcn.00432e82
or dword [esp + 0x448], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00402286
xor esi, esi
cmp dword [edi + 0xc], esi
jg 0x437aec
jl 0x437b5c
cmp dword [edi + 8], esi
ja 0x437aec
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0043ca4a
mov esp, ebp
pop ebp
ret 4
Function at 0x437d22
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x467034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x437d7c
cmp dword [ebp - 0x108], 2
jne 0x437d7c
cmp dword [ebp - 0x114], 6
jb 0x437d7c
mov al, 1
jmp 0x437d7e
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ca4a
leave
ret
Function at 0x438821
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4474d3
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x183c
call fcn.0043fd70
mov eax, dword [0x467034]
xor eax, esp
mov dword [esp + 0x1838], eax
push ebx
push esi
push edi
mov eax, dword [0x467034]
xor eax, esp
push eax
lea eax, [esp + 0x1850]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x24]
push eax
push 0x1000
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
mov edi, dword [esp + 0x24]
xor ebx, ebx
and dword [esp + 0x20], ebx
xor esi, esi
shr edi, 2
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
and dword [esp + 0x1858], ebx
test edi, edi
je 0x438981
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x44]
mov dword [esp + 0x14], eax
push dword [eax]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x28], esi
push 0x400
lea eax, [esp + 0x1048]
push eax
push esi
mov byte [esp + 0x1864], 1
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x438954
xor eax, eax
and dword [esp + 0x3c], eax
mov word [esp + 0x1842], ax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x1044]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 7
call fcn.0040c0fb
lea eax, [ebx + 0x5c]
mov byte [esp + 0x1858], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x438928
mov eax, dword [eax]
push ecx
push 0
push eax
lea ecx, [esp + 0x38]
call fcn.0040c17a
cmp eax, 0xffffffff
je 0x438947
push dword [esp + 0x14]
lea ecx, [esp + 0x1c]
call fcn.0041a64d
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.0040253d
mov byte [esp + 0x1858], 0
test esi, esi
je 0x438967
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp + 0x14], eax
dec edi
jne 0x4388b1
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov edi, esi
mov byte [eax + 0x58], 0
cmp esi, ebx
je 0x4389a9
mov esi, eax
push dword [edi]
mov ecx, esi
call fcn.00438582
add edi, 4
cmp edi, ebx
jne 0x438991
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov bl, byte [eax + 0x58]
test esi, esi
je 0x4389b8
push esi
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
pop ecx
mov al, bl
mov ecx, dword [esp + 0x1850]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1838]
xor ecx, esp
call fcn.0043ca4a
mov esp, ebp
pop ebp
ret
Function at 0x43925f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
test esi, esi
je 0x4392bd
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4392bd
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43928d
shr eax, 4
and eax, 1
jmp 0x4392bf
push esi
call dword [sym.imp.SHLWAPI.dll_StrDupW]
push 0x5c
mov edi, eax
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x4392d9
xor ecx, ecx
mov word [eax], cx
push edi
mov ecx, ebx
call fcn.0043925f
push edi
test eax, eax
jne 0x4392c6
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4392bd
xor eax, eax
inc eax
jmp 0x4392bf
Function at 0x4392de
Capabilities:
Timestomp file

Disassembly:
push 0x4c
mov eax, 0x447635
call fcn.0043fe00
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x48], esi
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_couldnt_open__S
push eax
mov dword [ebp - 4], ebx
call fcn.0040f360
add esp, 0xc
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
jne 0x43932b
mov ecx, eax
call fcn.00432e82
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00402286
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_GetFileTime:__S
push eax
call fcn.0040f360
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x43936c
mov ecx, ebx
call fcn.00432e82
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402286
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_DosDateTimeToFileTime:__S
push eax
call fcn.0040f360
add esp, 0xc
mov ebx, eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
push ecx
shr ecx, 0x10
push ecx
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
jne 0x4393ad
mov ecx, ebx
call fcn.00432e82
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402286
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_LocalFileTimeToFileTime:__S
push eax
call fcn.0040f360
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
jne 0x4393ea
mov ecx, ebx
call fcn.00432e82
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402286
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_SetFileTime:__S
push eax
call fcn.0040f360
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x43942c
mov ecx, edi
call fcn.00432e82
lea ecx, [ebp - 0x2c]
call fcn.00402286
test esi, esi
je 0x43943f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0043fdaf
ret 8

Function at 0x4394ee
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0xff
mov esi, dword [edi]
mov eax, esi
xor eax, dword [ebp + 8]
mov ecx, dword [edi + 8]
and eax, ebx
shr esi, 8
mov eax, dword [edx + eax*4]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [edi + 8], ecx
pop edi
pop esi
pop ebx
pop ebp
ret