joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42af42
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00454a97
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043ae66
push dword [ebp + 8]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.00454ae3
add esp, 0x10
call fcn.00425ff1
test al, al
invalid
je 0x42af95
fbstp tbyte [ecx - 0x75]
push es
xor byte [esi + edi*4], dh
lahf
popfd
xor dword [edx - 0x64], esi
or ax, 0x9ae5
mov eax, dword [ebp - 8]
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0xc], ebx
test eax, eax
js 0x42b05f
cmp word [edi + ebx*2], 0x5c
jne 0x42b050
call fcn.00425d3f
test al, al
je 0x42afd0
inc edx
pop edi
cmpsd dword [esi], dword es:[edi]
and ebx, dword [edi]
test bh, cl
and esp, ebp
xchg esp, eax
xchg esi, eax
sti
cmpsb byte [esi], byte es:[edi]
imul esi, dword [edx + ecx*8 + 0x276319f8], 0xffffffe8
xchg dword [ebx - 0x3f7b0001], ebp
call fcn.00425b5c
test al, al
je 0x42affa
add eax, 0x9fb3acb8
mov dl, 0xa7
jb 0x42af7f
ficom word [edx]
mov byte [0xa5b2f8ea], al
cmp dword [edx], esi
sti
bswap edx
test ecx, 0xd13eb8d2
xchg ebx, eax
jge 0x42af83
jge 0x42aff6
call fcn.00425c2b
test al, al
je 0x42b025
rol byte [edx - 0x45], 0xde
mov byte [0xb17ea38e], al
xchg edx, eax
scasb al, byte es:[edi]
int3
mov ebx, dword [ebp - 0xc]
xor eax, eax
push edi
movzx esi, word [edi + ebx*2]
mov word [edi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b049
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42b06f
mov eax, dword [ebp - 8]
mov word [edi + ebx*2], si
inc ebx
mov dword [ebp - 0xc], ebx
cmp ebx, eax
jle 0x42afa8
xor esi, esi
inc esi
push edi
call fcn.0043ae6f
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x42b05f
Function at 0x42b073
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
cld
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push eax
push 0x1a
push ecx
push eax
mov dword [ebp - 0x210], ebx
call fcn.0042ba3b
lea eax, [ebp - 0x20c]
push eax
call fcn.00454a97
add esp, 0x14
mov dword [ebp - 0x214], eax
call fcn.00425ad2
test al, al
je 0x42b0ea
lds ebp, [esp + ebp*8 - 2]
jmp 0x42b085
cmp dword [ebp - 0x214], 0
je 0x42b1f6
invalid
mov esi, 0x5a7cc8
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00454ab2
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00454ab2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00454ab2
add esp, 0x18
call fcn.0042607b
test al, al
je 0x42b14a
pop eax
inc esi
std
sbb esp, edx
jbe 0x42b0ee
iretd
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b168
lea eax, [ebp - 0x20c]
push eax
call fcn.0042af42
pop ecx
call fcn.00425ba1
test al, al
je 0x42b185
jb 0x42b1af
cmp byte [ebx], bh
push 0xffffffffffffffd5
xchg ebp, eax
lcall 0x6aa8, 0x1dc62e30
sbb al, 0x46
sbb dword [ebp - 0x361738cb], edi
lodsb al, byte [esi]
invalid
call fcn.00425e53
test al, al
je 0x42b1aa
mov dh, 0xdf
cld
lahf
enter 0xffffffffffffc8cf, 0x54
add edx, dword [esi]
ficom word [ecx + 0x61]
mov bh, 0x87
pop esp
mov esp, 0xf9b2b758
cmpsd dword [esi], dword es:[edi]
sbb al, 0x56
pop edx
xchg edi, eax
rcr byte [edx], 0xe8
int3
call fcn.0042607b
test al, al
je 0x42b1c8
dec esp
invalid
cmp word [ebp - 0x20c], 0
jne 0x42b1d6
xor eax, eax
jmp 0x42b1e3
lea eax, [ebp - 0x20c]
push eax
call fcn.00454a97
pop ecx
mov ecx, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402100
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
Function at 0x42b452
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x633530], 0
push ebx
push esi
push edi
je 0x42b4da
call fcn.00425ba1
test al, al
je 0x42b48e
xchg edx, eax
mov edx, 0x7c8be4e4
wait
lea esi, [eax + 0x30]
mov dword [0x9a74b36a], eax
or dh, ch
movmskps ebp, xmm0
shr byte [ecx - 0x3f7b0001], 0x74
sbb al, 0xf0
not byte [edi + ecx*2]
call fcn.00425e53
test al, al
je 0x42b4b3
lock not byte [edi + ecx*2]
xor byte [ebx], bl
out dx, eax
xor ebx, dword [eax]
inc eax
and bh, byte [eax + 0x66]
dec esp
mov ebp, 0x3762e38e
invalid
call fcn.0042607b
test al, al
je 0x42b5d1
or eax, ebp
jecxz 0x42b523
mov bl, 7
or al, 0xd1
in al, dx
mov edi, 0xf07acaf7
cmpsb byte [esi], byte es:[edi]
jo 0x42b497
pop ss
outsb dx, byte [esi]
mov byte [0xf7e91c], al
add byte [eax], al
call fcn.0042607b
test al, al
je 0x42b4fe
ret
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b56e
or al, 0x8d
test esp, esi
std
invalid
xor al, 0x73
pop edx
add byte [ebp - 0x72bc8b40], al
test esp, esi
std
invalid
lea eax, [ebp - 0x20c]
push eax
call fcn.00452ac7
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.004465ad
pop ecx
pop ecx
pop edx
add byte [eax - 0x18], dl
arpl word [eax + 0x59590001], si
test eax, eax
jne 0x42b567
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.004465ad
pop ecx
pop ecx
add byte [eax - 0x18], dl
dec esp
mov al, 1
add byte [ecx + 0x59], bl
test eax, eax
je 0x42b56e
mov byte [0x633530], 1
call fcn.00425edd
test al, al
je 0x42b589
jp 0x42b513
pop ss
fst st(7)
retf
call fcn.00425ba1
test al, al
je 0x42b5ad
jl 0x42b59e
adc cl, dh
or ebx, dword [ebp + eax*4 + 0x61485fbc]
shl byte [esi + 0x1d], 0xfc
xchg esp, eax
sbb ax, 0x94fc
fcmovb st(0), st(7)
mov ecx, 0xd7b80fa5
add esi, ebx
jns 0x42b55a
call fcn.00425ba1
test al, al
je 0x42b5d1
adc dword [edi + 0x35004607], eax
mov al, 0xf7
push esi
jnp 0x42b542
pop ebp
invalid
mov ecx, dword [ebp - 4]
mov al, byte [0x633530]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
Function at 0x42ba3b
Capabilities:
Get common file path

Disassembly:
invalid
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.0042b452
xor edi, edi
inc edi
test al, al
je 0x42bad8
call fcn.00425be6
test al, al
je 0x42ba77
cmpsb byte [esi], byte es:[edi]
jo 0x42bab6
ficomp dword [esi + esi*4]
jl 0x42b9fc
nop
imul esp, dword [edx - 0x35ea3308], 0xffffffbd
push esp
xor edi, edi
xor ebx, ebx
inc edi
call fcn.00425b5c
test al, al
je 0x42ba98
mov ecx, 0xe333c012
invalid
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call int.0042b2e7
pop ecx
test al, al
je 0x42bad8
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmp byte [ebx + 0x5a], dh
add byte [ebp - 0x2449f040], al
cmove ebx, edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x42bb23
call fcn.00425c70
test al, al
je 0x42bb00
in al, 0x1f
in al, dx
fmul st(1)
into
or al, byte [eax]
xor dword [0xa22df61d], eax
mov dh, 0x1b
clc
xchg ecx, eax
std
push 0xffffffffffffffb6
push edi
cmp dl, dh
pop ebp
xor dword [esi + 0x17], esp
imul ebx, dword [eax - 0xeb8a01], 0x75
adc bh, bh
jne 0x42bb15
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 4]
test eax, eax
push 1
movzx ecx, dl
pop eax
cmovne ecx, eax
mov byte [ebp - 4], cl
call fcn.0042607b
test al, al
je 0x42bb47
pop esp
adc eax, 0x7b371ba9
rcl byte gs:[ecx - 0x6910ff73], 0x47
xchg edi, eax
or eax, 0xbfb05817
sbb byte [edi - 0x23f1fb14], dl
inc ebx
mov edx, dword [ebp - 4]
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c595
Capabilities:
Check os version
Link function at runtime on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x42c5c1
call fcn.0042c8d7
neg eax
sbb eax, eax
inc eax
jmp 0x42c67d
call fcn.00425b17
test al, al
je 0x42c5e9
or ecx, dword [esi]
xchg byte [edi], dl
jge 0x42c5ef
push cs
mov al, 0xe4
jno 0x42c64e
and eax, 0x46c3086
sti
invalid
push 0x5abd68
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x28]
push ecx
call eax
call fcn.00425dc9
test al, al
je 0x42c61b
push es
adc eax, 0x79a0f5d3
aad 0x9c
or al, 0x30
add byte [edx + ebp + 0x45], dl
pop ds
sub eax, dword [ecx]
push 0xc6bcbf9d
call fcn.00425b5c
test al, al
je 0x42c63c
push 0xffffffffffffffe2
mov dh, 5
jbe 0x42c6a7
imul ecx, dword [ebx + 0x41072d4e], 0xffffff88
xor dword [edi + 0x1d31a2ce], 0xffffffaa
daa
in al, dx
push edi
invalid
call fcn.00425be6
test al, al
je 0x42c65d
lcall 0xdaf7, 0xce3096a6
movsd dword es:[edi], dword [esi]
invalid
fcom qword [edx - 0x1878ba82]
int1
or byte [0x734b17c], al
ret
cmp word [ebp - 0x28], 9
je 0x42c66f
cmp word [ebp - 0x28], 6
je 0x42c66f
xor esi, esi
jmp 0x42c672
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add byte [eax - 0x18], dl
pushfd
add dword [eax], eax
add esp, 0xc
mov dword [ebp - 0x120], esi
call fcn.00425dc9
test al, al
je 0x42c6d7
retf 0x3580
call fcn.00425b5c
test al, al
je 0x42c6f8
fidivr dword [ebx + 0x5abecf4]
sbb al, 0x6c
dec eax
mov edx, 0x97a1a735
cmp byte [edi + 0x30], dh
cwde
stosd dword es:[edi], eax
mov ebx, 0xc50caa78
call fcn.00425be6
test al, al
je 0x42c719
invalid
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x42c749
xor eax, eax
inc eax
cmp dword [ebp - 0x118], 0
je 0x42c743
cmp dword [ebp - 0x118], eax
jne 0x42c749
cmp byte [ebp - 6], 1
je 0x42c7a8
call fcn.00425e53
test al, al
je 0x42c76d
scasb al, byte es:[edi]
jmp 0xabad62b6
call fcn.00425cb5
test al, al
je 0x42c78b
or al, 0x79
scasd eax, dword es:[edi]
out dx, al
add eax, 0xb828ef88
adc dword [ecx - 0x61], eax
inc edi
invalid
call fcn.00425e0e
test al, al
je 0x42c7a6
cmp ecx, dword [eax]
jns 0x42c739
clc
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
Function at 0x42c8d7
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
invalid
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.00425e53
test al, al
je 0x42c94a
ror byte [ebx + 0x5c8c7c0b], cl
push ebx
jo 0x42c95c
adc eax, 0xabe4c649
out dx, eax
and al, 0x25
xchg esi, eax
jg 0x42c8f1
loop 0x42c91e
xor bp, word [0xf0c65bed]
call fcn.00425f67
test al, al
je 0x42c971
lodsd eax, dword [esi]
popfd
in al, dx
loopne 0x42c92b
out dx, al
insb byte es:[edi], dx
xor ch, byte [esi]
mov edi, 0xe8ca42d7
aad 0x1e
popfd
sub dh, al
and esi, dword [edi + 0x11]
adc ebp, dword [eax + esi*8 - 0x4b]
aaa
test dword [edx + edx*2], edx
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.00425b17
test al, al
je 0x42c9a5
mov cl, 0xaa
salc
add al, 0x3e
mov bh, 0x1e
mov ebp, 0xd0cb1653
xchg ecx, eax
sbb eax, 0xabaae60f
lcall 0xa135, 0x4e0b36c2
call 0x691c0ee2
add dword [ebx + 0xa7f05ff], 0xffffff83
inc byte [edx]
cmp edi, 5
jg 0x42c9b4
cmp esi, 2
jg 0x42c9b4
xor eax, eax
inc eax
jmp 0x42c9b6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
Function at 0x430e42
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x5a503f
call fcn.0043b389
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x24c], 0
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004463a0
add esp, 0xc
call fcn.00425d84
test al, al
je 0x430e95
adc dword [eax], edx
dec ebp
ja 0x430eda
mov dh, byte [edi + 0x16]
ret 0xf235
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
jmp 0x430f9d
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x430f8f
call fcn.00425e53
test al, al
je 0x430edf
or dword [esp], edx
mov al, byte [0x73727c90]
invalid
sub edx, dword cs:[esp + esi*2]
pop ebp
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x430f0f
lea eax, [ebp - 0x218]
push eax
call fcn.00454a97
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402100
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004328be
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0042548f
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x250]
call fcn.0043195d
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.0040c090
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x430ea9
call fcn.0043b344
ret
Function at 0x431dac
Capabilities:
Set registry value

Disassembly:
pop edx
add byte [edi + 0x5e], bl
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
call fcn.0042607b
test al, al
je 0x431ddd
pop ecx
fcom qword [edx - 0x7a]
pop edx
jbe 0x431dce
add byte [edi - 0x7f], al
pop edi
cmp al, 0x79
sbb al, 0x95
je 0x431da3
invalid
call fcn.00425ff1
test al, al
je 0x431e01
push eax
pushfd
dec ecx
mov dl, 0xdd
xchg esi, eax
and al, 0x6c
fadd qword [eax]
mov edx, 0xa5df394d
cmp edi, dword [edi]
dec esp
bound ebp, qword [0x14aa12a3]
dec ebx
dec ebx
push eax
call fcn.00425fac
test al, al
je 0x431e23
xchg edi, eax
jno 0x431da7
fcom qword [edi + 0x383b5a28]
aad 0xde
das
mov ebp, 0x676c802e
int3
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0xf013f
push ebx
push 0x5a9254
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431f78
call fcn.00425fac
test al, al
je 0x431e6e
test al, 0x3c
movsb byte es:[edi], byte [esi]
xchg esi, eax
retf 0xfd5c
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x431e9a
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x431f78
call fcn.0042607b
test al, al
je 0x431ec0
stc
xchg ebx, eax
test eax, 0xa38cb438
and al, 0xdf
xchg edx, eax
and bh, byte [edi + 0x6d207838]
xor edx, dword [edx - 0x18]
daa
ret
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x431ef1
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x431f76
call fcn.00425ad2
test al, al
je 0x431f1a
retf 0x41f1
call fcn.00425f67
test al, al
je 0x431f3f
jns 0x431f8c
cmp byte [edx - 0x3c], ch
adc eax, 0x28ca70e2
daa
and eax, 0x894a5fb8
out 0x36, al
inc esi
push ss
xchg ecx, eax
aad 0xfc
mov dword [0xbed7e9d4], eax
push dword [ebp + 0x14]
call fcn.00454a97
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add byte [eax], al
add byte [eax + 0x56], dl
mov eax, dword [0x62e15c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
push dword [eax + 4]
call fcn.00413080
mov eax, dword [esi]
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
and dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43341d
Capabilities:
Create process on windows

Disassembly:
push 0x28
mov eax, 0x5a5384
call fcn.0043b389
mov ebx, dword [ebp + 8]
mov ecx, ebx
and dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
and dword [ebp - 0x2c], 0
push 0x5a765c
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
call fcn.00407060
and dword [ebp - 4], 0
mov esi, dword [edi + 0x10]
mov dword [ebp - 0x2c], 1
jmp 0x43348e
push 1
lea eax, [esi - 1]
mov ecx, edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00414030
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.00406ca0
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0040c090
dec esi
test esi, esi
jg 0x433459
call fcn.00425e53
test al, al
je 0x4334b8
xlatb
sar byte [ecx + 0x75cf4a4], 0x5a
fmul qword [ecx]
jno 0x433449
jp 0x4334b5
ror dword ds:[ebx], cl
inc esi
invalid
adc eax, 0xaae85c7e
sub bh, bh
inc dword [eax + eax*8 + 0x21c71e74]
mov al, 0xa3
out dx, eax
jp 0x4334e7
call fcn.00425f67
test al, al
je 0x4334df
invalid
invalid
mov eax, dword [ebp - 0x30]
call fcn.0043b344
ret 8

Function at 0x4334ea
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.004463a0
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x2c], eax
mov eax, 0x200
mov dword [ebp - 0x20], 1
lea ecx, [eax + 0x40]
cmovne eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
call fcn.0042c8d7
test eax, eax
mov ecx, str.runas
lea eax, [ebp - 0x3c]
cmovne ecx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x433557
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x43356c
cmp dword [ebp + 0x10], 0
je 0x433569
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x43417a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
push edi
push 0x44
xor ebx, ebx
push ebx
push eax
call fcn.004463a0
push 0x10
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x82c], 0x44
push ebx
push eax
call fcn.004463a0
add esp, 0x18
call fcn.00425b17
test al, al
je 0x4341ea
invalid
push esi
lea eax, [ebp - 0x7d4]
push 0x5a9074
push eax
call fcn.00408e00
add esp, 0xc
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4342ac
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x7e8]
push eax
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call fcn.00425c70
test al, al
je 0x43426f
pop ss
add al, 0x68
invalid
call fcn.00425b17
test al, al
je 0x434296
mov ch, 0x37
mov bh, 0x3c
test dword [edi + 0x77a0b3de], edi
loope 0x4342d6
js 0x4342c8
jae 0x4342b5
inc esp
mov cl, 0xba
sub dh, al
mov esi, 0xa0b3b439
or ebp, dword [edx + 0x74]
wait
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ae55
pushfd
imul eax, dword [eax], 0
mov esp, ebp
pop ebp
ret
add byte [eax], al

Function at 0x434677
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.004259be
test al, al
je 0x43469c
pushal
mov cl, 0x46
das
push ebx
sub esp, edi
sbb dword [ebp - 0x3b], ebp
mov ebx, 0x4234ce01
imul edi, edi, 0x68530875
adc byte [eax + eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_OpenProcess
push dword [ebp + 8]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4346cf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
xor ecx, ecx
inc ecx
test eax, eax
push esi
cmovne ebx, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00425ff1
test al, al
je 0x4346eb
and cl, cl
lodsb al, byte [esi]
aaa
jno 0x4346fc
xor byte [0x28659e95], ch
xor al, 0x61
out 0x11, eax
mov ebx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
or byte [edi + 0x56], dl
call fcn.00454a97
push dword [ebp + 0xc]
mov edi, eax
call fcn.00454a97
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp - 4], ebx
call fcn.00425ff1
test al, al
je 0x434734
fimul word [edi - 0xba67a30]
pop ss
inc edx
pop esp
sal byte [0x12831d9], 0x98
mov ebx, dword [ebp - 4]
mov esi, dword [ebp + 8]
cmp edi, ebx
jl 0x43474f
push dword [ebp + 0xc]
sub edi, ebx
lea eax, [esi + edi*2]
push eax
call fcn.004527a9
pop ecx
pop ecx
test eax, eax
jne 0x43474f
inc eax
jmp 0x434751
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434758
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0xc]
push edi
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00403660
call fcn.0042bb53
and dword [ebp - 0x24], 0
lea edi, [ebp - 0x20]
add esp, 0x18
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x614
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x434922
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x42c
mov eax, 0x5a541c
call fcn.0043b389
mov edi, ecx
mov esi, 0x208
lea eax, [ebp - 0x420]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004463a0
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004463a0
add esp, 0x18
lea eax, [ebp - 0x438]
mov ecx, edi
push eax
call fcn.004350bb
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push str.Dict
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
push 0x5aa858
push eax
call fcn.00408e00
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00454ae3
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.00454ab2
lea eax, [ebp - 0x218]
push 0x5a7cc8
push eax
call fcn.00454ab2
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
add esp, 0x28
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43488e
push 0
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00434758
call fcn.0042583e
mov ecx, eax
call fcn.00435ce0
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00454ae3
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.00454ab2
lea eax, [ebp - 0x218]
push 0x5a7cc8
push eax
call fcn.00454ab2
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x4348f8
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00434758
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.0042548f
call fcn.0043b344
ret
jmp 0x4347b1