joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40995a
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x4507e0
call fcn.0042c0a7
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x409a5f
cmp byte [ebx + 0x3d], 0
je 0x409a5f
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40998f
xor al, al
jmp 0x409a61
xor eax, eax
lea ecx, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 8
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.00408d20
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4099f3
sub eax, 1
je 0x4099f7
dec eax
sub eax, 1
je 0x409a49
xor bl, bl
jmp 0x409a4b
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x409a2f
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00433ea2
add esp, 0x10
cmp esi, eax
jne 0x4099ef
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x409a49
test esi, esi
jne 0x4099b9
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00404bda
jmp 0x4099b3
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push 0
push 1
call fcn.004065e1
mov al, bl
jmp 0x409a61
mov al, 1
call fcn.0042c051
ret

Function at 0x40b180
Capabilities:
Query environment variable

Disassembly:
push 0x210
mov eax, 0x450c55
call fcn.0042c0a7
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, ebx
test esi, esi
je 0x40b24d
cmp word [esi], bx
je 0x40b24d
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x40b1d5
push esi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00434581
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.0040eb4a
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0040b126
test eax, eax
jne 0x40b24d
push 0x38
call fcn.0042b6d1
mov esi, eax
pop ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 4]
mov byte [esi], 1
call fcn.00403e25
mov byte [ebp - 4], 1
xor eax, eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ebx
mov word [esi + 0x20], ax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x21c]
push eax
lea ecx, [edi + 0x40]
mov dword [ebp - 0x21c], esi
call fcn.0040a8b1
mov eax, dword [ebp - 0x21c]
call fcn.0042c051
ret 4
Function at 0x40c1d4
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x450eea
call fcn.0042c0a7
mov ebx, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x2c], eax
cmp dword [ebx + 0x2e4], edi
jle 0x40c2a7
cmp eax, 0xffffffff
je 0x40c2a7
push str.____Queued_Lines_End_____r_n
lea ecx, [ebp - 0x28]
call fcn.00403e25
mov dword [ebp - 4], 1
lea esi, [ebx + 0x2d4]
push eax
mov ecx, esi
call fcn.0040da94
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.00406923
jmp 0x40c29e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0040e01d
mov edx, eax
mov eax, dword [edx]
test eax, eax
je 0x40c247
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
mov ecx, dword [eax + ecx*4]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x40c25f
mov ecx, dword [ecx]
push 0
lea edx, [ebp - 0x30]
add eax, eax
push edx
push eax
push ecx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c279
add edi, dword [ebp - 0x30]
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
dec ecx
and ecx, dword [esi + 0xc]
push 0
push 1
mov ecx, dword [eax + ecx*4]
call fcn.00406923
sub dword [esi + 0x10], 1
jne 0x40c29b
and dword [esi + 0xc], 0
jmp 0x40c29e
inc dword [esi + 0xc]
cmp dword [ebx + 0x2e4], 0
ja 0x40c232
mov eax, edi
call fcn.0042c051
ret 8
Function at 0x40cd93
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x47f070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
xor esi, esi
mov ebx, ecx
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40ce1b
lea eax, [ebp - 0x408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40ce14
test dword [ebp - 0x408], 0xfffffffc
jbe 0x40ce14
add ebx, 0xbc
push 0x104
push ebx
push dword [ebp + esi*4 - 0x404]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x408]
inc esi
shr eax, 2
cmp esi, eax
jb 0x40cdf3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b6bb
mov esp, ebp
pop ebp
ret 4
Function at 0x40e1a3
Capabilities:
Check mutex on windows

Disassembly:
push 0x54
mov eax, 0x45121e
call fcn.0042c0a7
mov esi, ecx
mov dword [ebp - 0x5c], esi
xor ebx, ebx
mov dword [ebp - 0x60], esi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x40e249
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, str.RegValues
call fcn.0040ed2e
push str.Lock
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.0040e5d0
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.00407dfa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push ebx
push 1
call fcn.00406923
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00406923
push 0x32
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40e2f4
push str.MappedFile
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040e5d0
pop ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov edi, 0x88
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x40e2dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 0xf001f
push dword [esi + 4]
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x40e2db
test ebx, ebx
je 0x40e2d6
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.0040aeb7
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xc]
inc dword [eax]
xor ebx, ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00406923
mov esi, dword [esi + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.00406923
mov eax, esi
call fcn.0042c051
ret 4
Function at 0x40e34d
Capabilities:
Check mutex on windows

Disassembly:
push 0x54
mov eax, 0x45128a
call fcn.0042c0a7
mov esi, ecx
mov dword [ebp - 0x5c], esi
xor ebx, ebx
mov dword [ebp - 0x60], esi
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x40e3f3
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, str.ExtMonitor
call fcn.0040ed2e
push str.Lock
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.0040e5d0
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.00407dfa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push ebx
push 1
call fcn.00406923
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00406923
push 0x32
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40e4dc
push str.MappedFile
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040e5d0
pop ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
push 0x48
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x40e4c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x48
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 0xf001f
push dword [esi + 4]
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x40e4c3
test ebx, ebx
je 0x40e4b1
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
xor ebx, ebx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], vtable.NGLogging::CExtMonitorSettings.0
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov byte [eax + 0x10], bl
mov dword [eax + 0x28], edi
mov dword [eax + 0x24], ebx
mov word [eax + 0x14], cx
mov byte [ebp - 4], 5
mov dword [eax + 0x40], edi
mov dword [eax + 0x3c], ebx
mov word [eax + 0x2c], cx
mov byte [ebp - 4], 6
mov dword [eax + 0x44], ebx
mov byte [ebp - 4], 3
jmp 0x40e4b3
xor ebx, ebx
mov ecx, dword [esi + 0xc]
lea eax, [ecx + 4]
neg ecx
sbb ecx, ecx
and ecx, eax
inc dword [ecx]
jmp 0x40e4c5
xor ebx, ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00406923
mov esi, dword [esi + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.00406923
mov eax, esi
call fcn.0042c051
ret 4
Function at 0x40ebef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x40ec71
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], ecx
push eax
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ec71
cmp dword [ebp - 8], 1
jne 0x40ec71
mov eax, dword [ebp - 4]
xor ecx, ecx
push esi
shr eax, 1
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b97a
mov esi, eax
pop ecx
test esi, esi
je 0x40ec70
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ec69
push esi
call fcn.004061c6
pop ecx
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.004060b9
push esi
call fcn.0042b983
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422f39
Capabilities:
Get file version info

Disassembly:
push 0x10
mov eax, 0x454f77
call fcn.0042c0de
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.NGUtils::AFileVersionInfo.0
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.NGUtils::CFileVersionInfo.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x42300f
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x42300f
mov byte [ebp - 4], 1
push ebx
call fcn.0042b97a
pop ecx
mov dword [esi + 0xc], eax
mov dword [ebp - 4], edi
jmp 0x422fb8
cmp dword [esi + 0xc], 0
je 0x42300f
push dword [esi + 0xc]
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x42300f
mov dword [ebp + 8], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x10]
push eax
push 0x46fad8
push dword [esi + 0xc]
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
call edi
test eax, eax
je 0x422ffd
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [esi + 8], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 4]
push eax
push 0x468974
push dword [esi + 0xc]
call edi
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0042c03c
ret 4

Function at 0x423410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret 0x28

Function at 0x4234e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4235c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esp, ebp
pop ebp
ret 8

Function at 0x423780
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret 4
Function at 0x4243a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esp, ebp
pop ebp
ret 8
Function at 0x425010
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x427c85
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, edi
jmp 0x427c9a
mov ebx, dword [ebp - 4]
add edi, 0x200
test esi, esi
je 0x427cab
push esi
call fcn.0042b983
pop ecx
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b97a
mov esi, eax
pop ecx
test esi, esi
je 0x427d17
xor eax, eax
mov word [esi], ax
lea eax, [ebx + 4]
cmp dword [eax + 0x14], 8
jb 0x427cd8
mov eax, dword [eax]
push eax
push edi
push esi
push 0x4634ec
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
lea ecx, [edi - 1]
cmp ebx, ecx
jae 0x427c97
push esi
call fcn.004061c6
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push esi
call fcn.004060b9
push esi
call fcn.0042b983
xor eax, eax
cmp eax, ebx
pop ecx
sbb eax, eax
neg eax
jmp 0x427d19
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x427d22
Capabilities:
Read .ini file

Disassembly:
push 0x2c
mov eax, 0x45567d
call fcn.0042c0a7
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x34], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
jmp 0x427d4e
mov ebx, dword [ebp - 0x2c]
add edi, 0x200
test esi, esi
je 0x427d5f
push esi
call fcn.0042b983
pop ecx
push edi
call fcn.0042b97a
mov esi, eax
pop ecx
test esi, esi
je 0x427e0f
xor eax, eax
mov byte [esi], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
mov dword [ebp - 4], eax
lea ecx, [ebx + 4]
cmp dword [ecx + 0x14], 8
jb 0x427d97
mov edx, dword [ecx]
jmp 0x427d99
mov edx, ecx
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
lea eax, [edx + eax*2]
jb 0x427da7
mov ecx, dword [ecx]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00428347
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push esi
push 0x463388
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004065e1
lea edx, [edi - 1]
cmp ebx, edx
jae 0x427d4b
push esi
call fcn.0040655b
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push esi
call fcn.004064e2
push esi
call fcn.0042b983
xor eax, eax
cmp eax, ebx
pop ecx
sbb eax, eax
neg eax
jmp 0x427e11
xor al, al
call fcn.0042c051
ret 0xc
Function at 0x428520
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esp, ebp
pop ebp
ret 4

Function at 0x428540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x428820
Capabilities:
Monitor local ipv4 address changes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_NotifyAddrChange]
mov esp, ebp
pop ebp
ret 8

Function at 0x429d35
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x455865
call fcn.0042c0a7
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x429e52
cmp byte [ebx + 0x3e], 0
je 0x429e52
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.0042c036
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x429d81
xor al, al
jmp 0x429e54
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00408d20
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x429db1
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.0042c036
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x429de6
sub eax, 1
je 0x429dea
dec eax
sub eax, 1
je 0x429e40
xor bl, bl
jmp 0x429e42
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x429dfa
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x429e22
cmp eax, 0x10
jae 0x429e09
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00433ea2
add esp, 0x10
cmp esi, eax
jne 0x429de2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x429e40
test esi, esi
jne 0x429da5
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404bda
jmp 0x429d9f
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004065e1
mov al, bl
jmp 0x429e54
mov al, 1
call fcn.0042c051
ret
Function at 0x42a053
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x4558ba
call fcn.0042c0a7
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x42a078
xor eax, eax
jmp 0x42a1f1
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x42a0a4
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x42a0a4
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x42a1f1
cmp dword [esi + 0x4c], 0
je 0x42a1ee
mov ecx, esi
call fcn.00429f2e
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x42a0d7
push dword [esi + 0x4c]
push edi
call fcn.0042992e
pop ecx
pop ecx
test al, al
je 0x42a1ee
movzx ebx, di
jmp 0x42a1ee
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00408d20
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x42a10f
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.0042c036
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x42a1e2
cmp eax, 1
jg 0x42a1bd
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x42a158
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x42a185
cmp eax, 0x10
jae 0x42a167
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.00433ea2
add esp, 0x10
cmp edi, eax
jne 0x42a1b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x42a188
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x42a1b2
test edi, edi
jne 0x42a103
cmp dword [ebp - 0x18], 0x20
jae 0x42a1dc
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404bda
jmp 0x42a0fd
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x42a1dc
cmp eax, 3
jne 0x42a1e2
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.0042992e
pop ecx
pop ecx
test al, al
je 0x42a1dc
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004065e1
mov ax, bx
call fcn.0042c051
ret 4

Function at 0x4409d7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044069a

Function at 0x4409e2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044081b

Function at 0x4468b4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446574
Function at 0x1000843f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, 0x208
push esi
push eax
mov word [ebp - 0x41c], ax
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
push eax
mov word [ebp - 0x210], ax
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
call sub.msvcrt.dll_memset
xor eax, eax
add esp, 0x18
mov word [edi], ax
mov esi, 0x105
push esi
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x100084c0
push 0x6f
call fcn.10009788
push eax
push 0x10001ed0
call fcn.10009770
pop ecx
pop ecx
push 0x6f
pop eax
jmp 0x100084f0
push esi
lea esi, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
call fcn.100083ac
test eax, eax
js 0x100084f0
mov eax, esi
push eax
push 0x10001f24
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
push 0x10001f44
push dword [ebp + 8]
push edi
call fcn.100078f5
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000cace
leave
ret 4