joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428270
Capabilities:
Create directory
Delete file
Get file size
Move file
Write file on windows

Disassembly:
mov eax, 0x1310
call fcn.00430cc0
push esi
push edi
lea eax, [esp + 0x214]
push 0x104
push eax
call fcn.00427eb0
add esp, 8
lea ecx, [esp + 0x318]
push 0x450e84
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x131c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x318]
push edx
push eax
call esi
lea ecx, [esp + 0x318]
push 0x44cf80
push ecx
call esi
lea edx, [esp + 0x214]
lea eax, [esp + 0xc]
push edx
push 0x452800
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0xc]
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x428348
lea edx, [esp + 0x214]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x428405
push 0
push 0x80
push 4
push 0
push 3
lea eax, [esp + 0x20]
push 0xc0000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x428405
push ebx
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x989680
jbe 0x4283ca
push esi
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x118]
push eax
call ebp
lea ecx, [esp + 0x118]
mov byte [esp + eax + 0x117], 0x5f
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x118]
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x80
push 4
push 0
push 3
lea ecx, [esp + 0x28]
push 0xc0000000
push ecx
call edi
mov esi, eax
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0x324]
push edx
push eax
call ebp
lea ecx, [esp + 0x328]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1310
ret
Function at 0x428850
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push 0x45282c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
test eax, eax
je 0x4288ad
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push esi
push edi
call fcn.00423930
test eax, eax
jne 0x4288c0
call fcn.00428930
jmp 0x4288cd
mov eax, dword [esp + 0x24]
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call edi
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x428914
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x428914
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], 0
test esi, esi
jne 0x42891c
call edi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x428930
Capabilities:
Shutdown system

Disassembly:
push ebp
push edi
push 0x4461f4
mov edi, 0x15
call fcn.00427f30
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x42894d
pop edi
pop ebp
ret
push ebx
push esi
push 0x452860
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x428963
xor esi, esi
jmp 0x4289a7
push 1
push 1
push 0
push 0
push 0
call eax
mov esi, eax
test esi, esi
jne 0x4289a7
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push esi
push 6
mov edi, eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, eax
test esi, esi
jne 0x428992
call ebx
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call ebx
push 0x1f4
call ebx
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x4289ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4289e1
push 0
call ebx
push 0
push 0x452850
call fcn.00424580
add esp, 8
push edi
call ebx
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
push edi
push 0x452840
call fcn.00424580
add esp, 8
push edi
call ebx
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x428a30
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, 0x425c
call fcn.00430cc0
push ebx
push ebp
push esi
push edi
mov ecx, 0x1056
xor eax, eax
lea edi, [esp + 0x114]
mov esi, 0x457308
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4270]
mov ecx, 0xf8d
mov dword [esp + 0x21c], eax
mov eax, 1
lea edi, [esp + 0x334]
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
push 0x104
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x11c]
xor ebp, ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x118]
push 0x450e78
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x452878
call fcn.00427f30
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x428afa
push 0x452884
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428af3
lea ecx, [esp + 0x114]
push ecx
call eax
test eax, eax
je 0x428af3
mov ecx, 0xf8d
lea esi, [esp + 0x334]
mov edi, 0x457308
mov ebp, 1
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 0x10]
push 0x4583e8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [esp + 0x14]
push 0x4583e8
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x425c
ret

Function at 0x428b30
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4158
call fcn.00430cc0
push ebx
push ebp
push esi
push edi
mov ecx, 0x1056
xor eax, eax
lea edi, [esp + 0x10]
mov esi, 0x457308
rep stosd dword es:[edi], eax
mov ecx, 0xf8d
lea edi, [esp + 0x230]
lea eax, [esp + 0x14]
push 0x104
rep movsd dword es:[edi], dword [esi]
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x14]
push 0x450e78
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x452878
call fcn.00427f30
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x428bcd
push 0x452894
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428bc6
lea edx, [esp + 0x10]
push edx
call eax
test eax, eax
je 0x428bc6
mov ecx, 0xf8d
lea esi, [esp + 0x230]
mov edi, 0x457308
mov ebp, 1
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x4158
ret
Function at 0x428be0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4158
call fcn.00430cc0
push ebx
push esi
push edi
mov ecx, 0x1056
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
xor ebx, ebx
mov ecx, 0xf8d
mov esi, 0x457308
lea edi, [esp + 0x22c]
lea eax, [esp + 0x10]
mov dword [esp + 0x118], 1
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], ebx
push 0x104
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
push 0x450e78
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x452878
call fcn.00427f30
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x428c86
push 0x4528a4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x428c7f
lea edx, [esp + 0xc]
push edx
call eax
test eax, eax
je 0x428c7f
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x4158
ret

Function at 0x428ca0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4158
call fcn.00430cc0
push ebx
push ebp
push esi
push edi
mov ecx, 0x1056
xor eax, eax
lea edi, [esp + 0x10]
xor ebp, ebp
rep stosd dword es:[edi], eax
mov eax, 1
mov ecx, 0xf8d
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov esi, 0x457308
lea edi, [esp + 0x230]
lea eax, [esp + 0x14]
mov dword [esp + 0x124], ebp
push 0x104
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x14]
push 0x450e78
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x452878
call fcn.00427f30
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x428d57
push 0x4528b8
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x428d50
lea edx, [esp + 0x10]
push edx
call eax
test eax, eax
je 0x428d50
mov ecx, 0xf8d
lea esi, [esp + 0x230]
mov edi, 0x457308
mov ebp, 1
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x4158
ret
Function at 0x428d70
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, 0x4360
call fcn.00430cc0
push ebx
push ebp
push esi
push edi
mov ecx, 0x1056
xor eax, eax
lea edi, [esp + 0x218]
mov esi, 0x457308
rep stosd dword es:[edi], eax
mov ecx, 0xf8d
lea edi, [esp + 0x438]
lea eax, [esp + 0x21c]
push 0x104
rep movsd dword es:[edi], dword [esi]
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x21c]
push 0x450e78
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x452878
call fcn.00427f30
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x428e29
push 0x452958
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428e14
lea edx, [esp + 0x218]
push edx
call eax
test eax, eax
je 0x428e14
mov ecx, 0xf8d
lea esi, [esp + 0x438]
mov edi, 0x457308
mov ebp, 1
rep movsd dword es:[edi], dword [esi]
jmp 0x428e87
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
lea eax, [esp + 0x14]
push 0x452910
push eax
jmp 0x428e3c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
lea ecx, [esp + 0x14]
push 0x4528c8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call fcn.00423bf0
test eax, eax
jne 0x428e77
mov eax, dword [0x457304]
test eax, eax
jne 0x428e77
push 0x1388
push 0x10010
lea edx, [esp + 0x18]
push 0x44f3c0
push edx
push 0
call fcn.00429240
add esp, 0x14
jmp 0x428e87
call esi
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00424580
add esp, 8
lea ecx, [esp + 0x114]
push 0x4583e8
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea edx, [esp + 0x118]
push 0x4583e8
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x4360
ret

Function at 0x428ed0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4158
call fcn.00430cc0
push ebx
push esi
push edi
mov ecx, 0x1056
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0xf8d
mov esi, 0x457308
lea edi, [esp + 0x22c]
lea eax, [esp + 0x10]
push 0x104
push eax
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
push 0x450e78
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x452878
call fcn.00427f30
mov esi, eax
add esp, 4
test esi, esi
je 0x428f59
push 0x452970
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428f52
lea edx, [esp + 0xc]
push edx
call eax
test eax, eax
je 0x428f52
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x4158
ret
Function at 0x428f70
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4158
call fcn.00430cc0
push ebx
push esi
push edi
mov ecx, 0x1056
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0xf8d
mov esi, 0x457308
lea edi, [esp + 0x22c]
lea eax, [esp + 0x10]
push 0x104
push eax
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
push 0x450e78
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x452878
call fcn.00427f30
mov esi, eax
add esp, 4
test esi, esi
je 0x42900f
push 0x452988
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x429008
lea edx, [esp + 0xc]
push edx
call eax
test eax, eax
je 0x429008
mov ecx, dword [esp + 0x4168]
lea eax, [esp + 0x124]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x4158
ret
Function at 0x429050
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 0x2e4
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push 0x441ea8
call dword [0x43b490]
mov eax, dword [esp + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x4290b4
push 0x104
lea ecx, [esp + 0x1f4]
push eax
push ecx
call fcn.00429020
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 1
call dword [0x43b48c]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4290b4
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 0x80000000
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x452a70
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 0x452a64
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
lea esi, [esp + 0x18]
mov eax, dword [esi + 4]
lea edx, [esp + 0x1f0]
push edx
lea ecx, [esp + 0xf0]
push eax
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0xec]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x42921b
mov edi, dword [esi + 0x10]
add esi, 0x10
cmp edi, ebx
jne 0x4290fb
mov edi, 0x80000002
mov eax, 0x450fec
mov ecx, 0x80000000
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x452a40
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0x452a18
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 0x4529e8
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
lea esi, [esp + 0x18]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x1f0]
push eax
lea edx, [esp + 0xf0]
push ecx
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0xec]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x42921b
mov edi, dword [esi + 0x10]
add esi, 0x10
cmp edi, ebx
jne 0x429194
lea ecx, [esp + 0x58]
mov dword [esp + 0x58], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x68], 2
jne 0x42921b
lea edx, [esp + 0x10]
push edx
push 0x4529a4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x42921b
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1f0]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2e4
ret
Function at 0x4292b0
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [0x4572fc]
sub esp, 0x334
lea eax, [esp + 0x30]
push esi
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x34]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4293b8
push edi
push esi
call fcn.0043052b
add esp, 4
mov edi, eax
lea ecx, [esp + 0x38]
push edi
push esi
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x42939d
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push 0x452ab0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42939d
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [eax]
mov dx, word [eax]
shr ecx, 0x10
push ecx
push edx
lea eax, [esp + 0x144]
push 0x452a88
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
lea eax, [esp + 0x13c]
push ecx
push edx
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
cmp byte [eax], 0
je 0x429387
cmp byte [eax], 0x2c
jne 0x429375
mov byte [eax], 0x2e
mov cl, byte [eax]
cmp cl, 0x20
je 0x42937f
mov byte [edx], cl
inc edx
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42936d
mov byte [edx], 0
mov edx, dword [esp + 0x340]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test edi, edi
je 0x4293aa
push edi
call fcn.0043090e
add esp, 4
pop edi
mov eax, 1
pop esi
add esp, 0x334
ret
xor eax, eax
pop esi
add esp, 0x334
ret

Function at 0x4293d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x429411
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
je 0x42942e
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x42942e
cmp dword [esp + 0xc], 5
jne 0x42942e
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
je 0x429430
xor eax, eax
pop edi
pop esi
add esp, 0x9c
ret

Function at 0x429440
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x429481
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
je 0x4294a6
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x4294a6
cmp dword [esp + 0xc], 5
jne 0x4294a6
cmp dword [esp + 0x10], 2
jne 0x4294a6
pop edi
mov eax, 1
pop esi
add esp, 0x9c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x9c
ret
Function at 0x4294c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push edi
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 7]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x429500
lea edx, [esp + 8]
push 0x446350
push edx
call esi
lea eax, [esp + 8]
push 0x451168
push eax
call esi
push 8
lea ecx, [esp + 0xc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x429569
push 0x452bac
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x429562
mov ecx, dword [0x457304]
test ecx, ecx
je 0x42954d
mov edx, dword [esp + 0x110]
push 0
push edx
call eax
test eax, eax
je 0x429562
jmp 0x42955d
mov ecx, dword [esp + 0x110]
push 1
push ecx
call eax
test eax, eax
je 0x429562
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x4297c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 3]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x4297fd
lea edx, [esp + 4]
push 0x446350
push edx
call esi
lea eax, [esp + 4]
push 0x451168
push eax
call esi
push 8
lea ecx, [esp + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x42983f
push 0x452bcc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x429838
mov edx, dword [esp + 0x10c]
push edx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
add esp, 0x104
ret
Function at 0x429d10
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x2d4
mov al, byte [0x4571f0]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x64], al
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x65]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xe0]
xor esi, esi
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xdc]
push 0x452e00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [esp + 0x2e8]
test ebx, ebx
je 0x429d72
lea eax, [esp + 0x64]
push 0x452de0
push eax
jmp 0x429d7c
lea ecx, [esp + 0x64]
push 0x452dbc
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
push 0x8001
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], 0x44
mov word [esp + 0x54], 0xa
mov dword [esp + 0x50], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0x30
push 0
push 0
lea ecx, [esp + 0x80]
push 0
lea edx, [esp + 0xfc]
push ecx
push edx
call ebp
test eax, eax
jne 0x429e22
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
lea eax, [esp + 0x1e4]
push 0x452d90
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call esi
lea ecx, [esp + 0x1e0]
push eax
push ecx
call fcn.00424580
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2d4
ret
mov eax, dword [esp + 0x10]
test eax, eax
je 0x429ea7
cmp eax, 0xffffffff
je 0x429ea7
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push eax
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
test ebx, ebx
je 0x429e97
lea eax, [esp + 0x64]
push 0x452dbc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push 0
push 0x30
push 0
push 0
lea eax, [esp + 0x80]
push 0
lea ecx, [esp + 0xfc]
push eax
push ecx
call ebp
test eax, eax
je 0x429e15
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2d4
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2d4
ret
Function at 0x404ac5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404b04
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404b04
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404b04
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404b04
cmp dword [ecx + 0x74], 0xe
jbe 0x404b04
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407276
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40f604
push 0x40f5fc
push str.FlsAlloc
push 0x1f
call fcn.00407559
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4072aa
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4072b0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4072f4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40f614
push 0x40f60c
push str.FlsGetValue
push 0x21
call fcn.00407559
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40732b
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407333
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40f61c
push 0x40f614
push str.FlsSetValue
push 0x22
call fcn.00407559
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40736d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]