joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f30
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4553bd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x47506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov esi, ecx
push 5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x403f8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
jmp 0x404131
cmp dword [esi + 0x14], 8
jb 0x403f92
mov esi, dword [esi]
push 5
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x403fc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov dword [ebp - 4], 2
jmp 0x404105
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x403ffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 4
jmp 0x404105
xor ecx, ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
push edi
mov dword [ebp - 0x10], ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x404110
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4040dc
mov eax, dword [ebp - 0x10]
push 0x476c81
push eax
mov dword [ebp - 0x18], eax
call fcn.00435daa
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
pop ecx
test esi, esi
jne 0x404062
push edi
mov dword [ebp - 4], 5
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 6
mov esi, 0x8007000e
jmp 0x404105
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x4040a8
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 4]
push esi
mov dword [ecx + 0x1c], eax
call fcn.00435d67
pop ecx
push edi
mov dword [ebp - 4], 0xd
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
mov dword [ebp - 4], 0xe
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x404131
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x1c]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
call fcn.00435d67
pop ecx
push edi
mov dword [ebp - 4], 7
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 8
jmp 0x404105
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
push edi
mov dword [ebp - 4], 9
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0xa
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x404131
push edi
mov dword [ebp - 4], 0xb
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
mov dword [ebp - 4], 0xc
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x8000ffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4055a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [edi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x4056f1
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov esi, 0x3ff
mov ecx, eax
cmp dword [edi], edx
je 0x4056f1
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x40561f
lea eax, [ecx + 0x2400]
cmp ax, si
ja 0x405700
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x40563c
mov dl, bl
xor eax, eax
jmp 0x40566c
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, si
ja 0x40560e
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x405611
mov edx, ebx
cmp ebx, 0x800
jae 0x405651
shr edx, 6
xor eax, eax
or dl, 0xc0
inc eax
jmp 0x40566c
cmp ebx, 0x10000
jae 0x405663
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x40566b
shr edx, 0x12
or dl, 0xf0
push 3
pop eax
movzx esi, cl
mov ecx, dword [ebp - 0xc]
xor esi, 1
add esi, esi
mov dword [ebp - 8], eax
cmp eax, 3
cmovb esi, eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [edi]
inc esi
cmp eax, esi
jl 0x4056f1
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
jne 0x4056a2
cmp ecx, 3
jae 0x4056a9
mov eax, dword [edi]
mov byte [eax], dl
inc dword [edi]
dec esi
test esi, esi
jle 0x4056c8
imul ecx, ecx, 6
mov eax, dword [edi]
sub ecx, 6
mov edx, ebx
dec esi
shr edx, cl
and dl, 0x3f
or dl, 0x80
mov byte [eax], dl
inc dword [edi]
test esi, esi
jg 0x4056b0
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x4055c9
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x4056f9
Function at 0x41dc2b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, ebx
mov edi, eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x41dc49
sub edx, ecx
sar edx, 1
lea eax, [edx + edi]
lea eax, [eax*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x41dcd9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
push 0x5c
pop eax
cmp word [esi + edx*2 - 2], ax
je 0x41dc8a
mov word [esi + edx*2], ax
inc edx
mov ecx, ebx
xor eax, eax
mov edi, eax
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x41dc96
sub ecx, dword [ebp - 8]
sar ecx, 1
je 0x41dcd7
lfence
lea edx, [esi + edx*2]
mov ax, word [ebx + edi*2]
mov ecx, ebx
mov word [edx], ax
inc edi
lea edx, [edx + 2]
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x41dcc2
sub ecx, dword [ebp - 8]
sar ecx, 1
cmp edi, ecx
jb 0x41dcaf
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41de3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41de50
test al, 0x50
jne 0x41de50
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x43aa43
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x43aa7e

Function at 0x43abf5
Capabilities:
Enumerate pe sections

Disassembly:
xor ebx, ebx
cmp eax, ebx
je 0x43b1fc
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43ac08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.0043aa03
mov ch, 0xa7
or eax, 0x47b70ff4
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0043aa03
pop ebp
dec esi
wait
scasb al, byte es:[edi]
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x43ac5d
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x43ac57
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x43ac48
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0043aa03
aas
sal byte [ecx - 0x57ba72ee], 0x50
call fcn.0043aa13
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0043a9c8
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x43acf1
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0043aa03
shr dword [edx + 0x458d563a], cl
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x418d80
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor dl, dl
push edi
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x418f5e
mov eax, ecx
cmp eax, 0x7c
je 0x418f5e
cmp eax, 0x29
jne 0x418dc3
cmp dword [esi + 0x10], 0
jne 0x418f5e
cmp eax, eax
jne 0x418dc3
test dword [esi + 0x50], 0x10000000
je 0x418f6b
jmp 0x418f15
cmp eax, 0x2e
jne 0x418e24
push 5
lea ecx, [esi + 0x24]
call fcn.00419150
mov ecx, dword [esi]
mov edx, dword [esi + 8]
cmp ecx, edx
je 0x418e18
cmp word [ecx], 0x5c
jne 0x418e13
lea eax, [ecx + 2]
cmp eax, edx
je 0x418e13
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x418dfd
movzx edi, word [eax]
cmp edi, 0x28
je 0x418e0f
cmp edi, 0x29
je 0x418e0f
test dl, 0x10
jne 0x418e13
movzx edx, word [eax]
cmp edx, 0x7b
je 0x418e0f
cmp edx, 0x7d
jne 0x418e13
mov dword [esi], eax
mov ecx, eax
lea eax, [ecx + 2]
mov dword [esi], eax
mov ecx, esi
call fcn.00416290
jmp 0x418f47
cmp eax, 0x5c
jne 0x418e83
mov ecx, esi
call fcn.00418d30
test byte [esi + 0x50], 0x80
je 0x418e77
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x418e55
push 4
lea ecx, [esi + 0x24]
call fcn.00419150
mov ecx, esi
call fcn.00418d30
jmp 0x418f4e
cmp eax, 0x42
jne 0x418e77
push 4
lea ecx, [esi + 0x24]
call fcn.00419150
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00418d30
jmp 0x418f4e
mov ecx, esi
call fcn.0041adf0
jmp 0x418f47
cmp eax, 0x5b
jne 0x418ea5
mov ecx, esi
call fcn.00418d30
mov ecx, esi
call fcn.0041ad40
cmp dword [esi + 0x4c], 0x5d
jne 0x418f72
jmp 0x418f40
cmp eax, 0x28
jne 0x418ed1
mov ecx, esi
call fcn.00418d30
mov ecx, esi
call fcn.0041afa0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x418f6b
mov ecx, esi
call fcn.00418d30
test bl, bl
je 0x418f4e
jmp 0x418f47
cmp eax, 0x5e
jne 0x418ee9
push 2
lea ecx, [esi + 0x24]
call fcn.00419150
mov ecx, esi
call fcn.00418d30
jmp 0x418f4e
cmp eax, 0x24
jne 0x418f01
push 3
lea ecx, [esi + 0x24]
call fcn.00419150
mov ecx, esi
call fcn.00418d30
jmp 0x418f4e
cmp eax, 0x2a
je 0x418f64
cmp eax, 0x2b
je 0x418f64
cmp eax, 0x3f
je 0x418f64
cmp eax, 0x7b
je 0x418f64
cmp ecx, 0x7d
jne 0x418f25
test dword [esi + 0x50], 0x10000000
je 0x418f79
jmp 0x418f33
cmp ecx, 0x5d
jne 0x418f33
test dword [esi + 0x50], 0x10000000
je 0x418f72
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041b1c0
mov ecx, esi
call fcn.00418d30
mov ecx, esi
call fcn.0041b060
mov ecx, dword [esi + 0x4c]
mov dl, 1
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x418d95
pop edi
pop esi
mov al, dl
pop ebx
ret
push 0xa
call fcn.00416280
push 5
call fcn.00416280
push 4
call fcn.00416280
push 6
call fcn.00416280
int3
Function at 0x433005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..pdata
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0xa7171
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x521a4323
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x420d30
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0x420b20
push ebp
call fcn.004213c0
mov eax, dword [0x88288c]
add esp, 8
test eax, eax
mov edi, eax
je 0x420d8d
mov esi, dword [edi + 4]
mov eax, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x420d7e
test cl, cl
je 0x420d7a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x420d7e
add eax, 2
add esi, 2
test cl, cl
jne 0x420d56
xor eax, eax
jmp 0x420d83
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x420dce
mov edi, dword [edi]
test edi, edi
jne 0x420d51
push 0xc
call fcn.0051b1e7
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x420ded
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x420e82
push ebp
push str.Cmd_AddServerCommand:__s_already_defined_n
call fcn.0042e2f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
push 0xc
push 0
push ebx
call fcn.0042b1c0
mov eax, ebp
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420e00
sub eax, edx
lea edi, [eax + 1]
push edi
call fcn.0051b1e7
mov esi, eax
add esp, 4
test esi, esi
jne 0x420e4c
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
push edi
push 0
push esi
call fcn.0042b1c0
mov edx, esi
add esp, 0xc
mov eax, ebp
sub edx, ebp
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x420e60
mov eax, dword [esp + 0x18]
mov dword [ebx + 4], esi
mov dword [ebx + 8], eax
mov ecx, dword [0x88288c]
mov dword [ebx], ecx
mov dword [0x88288c], ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4213c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x882890]
test eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
je 0x42140f
mov esi, dword [edi + 4]
mov eax, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x421400
test cl, cl
je 0x4213fc
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x421400
add eax, 2
add esi, 2
test cl, cl
jne 0x4213d8
xor eax, eax
jmp 0x421405
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x421450
mov edi, dword [edi]
test edi, edi
jne 0x4213d3
push 0xc
call fcn.0051b1e7
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x42146f
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x421502
push ebp
push str.Cmd_AddCommand:__s_already_defined_n
call fcn.0042e2f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
push 0xc
push 0
push ebx
call fcn.0042b1c0
mov eax, ebp
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421481
sub eax, edx
lea edi, [eax + 1]
push edi
call fcn.0051b1e7
mov esi, eax
add esp, 4
test esi, esi
jne 0x4214cd
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
push edi
push 0
push esi
call fcn.0042b1c0
mov edx, esi
add esp, 0xc
mov eax, ebp
sub edx, ebp
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4214e0
mov eax, dword [esp + 0x18]
mov dword [ebx + 4], esi
mov dword [ebx + 8], eax
mov ecx, dword [0x882890]
mov dword [ebx], ecx
mov dword [0x882890], ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x422f60
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x104
mov eax, dword [0x562940]
xor eax, dword [esp + 0x104]
mov edx, dword [0x14deb60]
mov dword [esp + 0x100], eax
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [edx + 4]
push ecx
push 0x14d27e0
call fcn.00421b00
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [esp + 0x108]
test ecx, ecx
mov ecx, eax
jne 0x422fb4
and ecx, 0xfffffffe
jmp 0x422fb7
or ecx, 1
cmp ecx, eax
jne 0x422fd6
xor eax, eax
mov ecx, dword [esp + 0x100]
xor ecx, dword [esp + 0x104]
add esp, 0x104
jmp fcn.00523319
push ecx
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0x100]
xor ecx, dword [esp + 0x104]
mov eax, 1
add esp, 0x104
jmp fcn.00523319
Function at 0x42a470
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.0051b1e7
mov esi, eax
add esp, 4
test esi, esi
jne 0x42a4b6
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
push edi
push 0
push esi
call fcn.0042b1c0
add esp, 0xc
pop edi
mov eax, esi
pop esi
ret

Function at 0x42a970
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x14daa2c]
test eax, eax
je 0x42a988
push 0x5568e8
push 0
call fcn.0042e650
add esp, 8
push 0x21
push 0x5568e4
push str.com_hunkMegs
call fcn.004319e0
mov eax, dword [eax + 0x20]
add esp, 0xc
cmp eax, 0x50
jge 0x42a9c1
push 0x50
push 0x50
push str.Minimum_com_hunkMegs_is__i__allocating__i_megs._n
mov dword [0x884e44], 0x5000000
call fcn.0042e2f0
add esp, 0xc
jmp 0x42a9c9
shl eax, 0x14
mov dword [0x884e44], eax
mov eax, dword [0x884e44]
add eax, 0x1f
push eax
call fcn.0051b1e7
add esp, 4
test eax, eax
mov dword [0x13f8dd4], eax
jne 0x42aa15
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
add eax, 0x1f
and eax, 0xffffffe0
mov dword [0x13f8dd4], eax
call fcn.004016d0
call fcn.004113f0
call fcn.0044afc0
call fcn.00404980
call fcn.0042abe0
call fcn.0044ec00
push fcn.0042a500
push str.meminfo
call fcn.004213c0
add esp, 8
ret

Function at 0x42ae60
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x13f8dd4]
test ecx, ecx
jne 0x42ae6f
jmp fcn.0042a470
mov eax, dword [0x884e70]
push ebx
mov ebx, eax
add eax, 0xf
push esi
mov esi, dword [esp + 0xc]
and eax, 0xfffffff0
add esi, 0x10
push edi
lea edi, [eax + ecx]
mov ecx, dword [0x884e58]
add eax, esi
add ecx, eax
mov dword [0x884e70], eax
cmp ecx, dword [0x884e44]
jle 0x42aecb
call fcn.0042a500
mov edx, dword [0x884e58]
mov ecx, dword [0x884e44]
mov eax, dword [0x884e70]
sub edx, ecx
add edx, eax
push edx
push esi
push 0x55679c
push 1
call fcn.0042e650
add esp, 0x10
mov dword [edi], 0x89537892
mov eax, dword [0x884e70]
sub eax, ebx
mov dword [edi + 4], eax
lea eax, [edi + 0x10]
pop edi
pop esi
pop ebx
ret
Function at 0x42e960
Capabilities:
Delete file
Hide graphical window
Terminate process

Disassembly:
mov eax, dword [0x14e4578]
test eax, eax
jne 0x42ea0d
mov eax, dword [0x13f8dd4]
test eax, eax
je 0x42e980
mov eax, dword [0x884e6c]
mov dword [0x884e70], eax
mov eax, dword [0x14e3394]
mov ecx, dword [0x884e54]
inc eax
mov dword [0x884e58], ecx
mov dword [0x14e3394], eax
jne 0x42e9a3
mov dword [0x14e3394], 1
mov eax, dword [0x8d6c38]
test eax, eax
mov dword [0x13f8d9c], 0
mov dword [0x13f8df4], 0
je 0x42e9e0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x8d6c38]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x8d6c38], 0
call fcn.0040f270
push str.EXE_SERVERQUIT
call fcn.0044c360
call fcn.0042abe0
call fcn.00430980
push 1
call fcn.00425870
add esp, 8
call fcn.004257f0
call fcn.00425830
jmp 0x451910
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call fcn.004500f0
mov eax, dword [0x8d6c40]
test eax, eax
je 0x451952
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x8d6c40]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
mov ecx, dword [0x8d6c40]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x8d6c40], 0
push 0x8d66f0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x8d52e0], 0
mov dword [0x8d52e4], 0
call fcn.00431960
call fcn.00421590
call fcn.0040d5a0
push 0
call fcn.0051c8f0
int3