joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f0f6
Capabilities:
Create thread
Resume thread

Disassembly:
push 8
mov eax, 0x459b9d
call fcn.004442d3
push 0xac
call fcn.004402d1
pop ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
test eax, eax
je 0x42f128
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.0043a976
mov esi, eax
jmp 0x42f12a
xor esi, esi
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x42f3e0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
jne 0x42f15e
test esi, esi
je 0x42f15a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
xor al, al
jmp 0x42f184
mov esi, 0x4723c8
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push dword [ebp - 0x10]
call fcn.00430434
push esi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov al, 1
call fcn.00444372
ret
Function at 0x430943
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x430965
call fcn.0041b520
jmp 0x430967
xor eax, eax
ret 8

Function at 0x430999
Capabilities:
Hash data via wincrypt

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4309b6
call fcn.0041b520
jmp 0x4309b8
xor eax, eax
ret 8

Function at 0x430a13
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push dword [esp + 4]
mov eax, dword [eax]
push 0
push dword [0x473004]
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x430a38
call fcn.0041b520
jmp 0x430a3a
xor eax, eax
ret 4

Function at 0x431c47
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, eax
xor edi, edi
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push 0x431e5d
push edi
push edi
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x431ca4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x2b
push 0x223a
push 0x461c30
call fcn.00433609
add esp, 0xc
push eax
add esi, 0xa8
push esi
call fcn.00433b72
add esp, 0xc
jmp 0x431d8a
mov edi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
push dword [esi + 0xc]
push eax
call edi
mov ebx, 0x102
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x431d2d
cmp dword [esi + 0x28], 0
jbe 0x431ccf
push 0xffffffffffffffff
push dword [ebp - 0xc]
call edi
mov dword [ebp - 8], eax
jmp 0x431d17
push 3
pop eax
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push 0x7d0
push dword [ebp - 0xc]
call edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
push 0x26
push 0x30c3
push 0x461c5c
call fcn.00433609
push eax
lea eax, [esi + 0xa8]
push eax
call fcn.00433b72
add esp, 0x14
cmp dword [ebp - 8], ebx
jne 0x431d2d
push dword [esi + 0xc]
push 0x26
push 0x3331
push 0x461c84
jmp 0x431d68
cmp dword [ebp - 8], 0xffffffff
jne 0x431d48
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x2a
push 0x365b
push 0x461cac
jmp 0x431d68
cmp dword [ebp - 8], 0
jne 0x431d59
mov al, byte [esi + 0xd4]
mov byte [ebp - 1], al
jmp 0x431d80
push dword [ebp - 8]
push 0x2c
push 0x2528
push 0x461cd8
call fcn.00433609
add esp, 0xc
push eax
add esi, 0xa8
push esi
call fcn.00433b72
add esp, 0xc
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret
Function at 0x432926
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x456dcb
call fcn.004442d3
mov esi, ecx
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x10]
mov byte [eax], bl
call fcn.00402810
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.0043263a
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x432a6d
push dword [ebp + 0xc]
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
call fcn.004325df
pop ecx
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push ebx
push dword [eax]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, edi
call fcn.004028e0
cmp dword [ebp - 0x18], ebx
je 0x432a6d
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [esi]
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
call edi
cmp dword [ebp - 0x1c], 4
jne 0x432a08
cmp dword [ebp - 0x14], 4
jne 0x432a64
cmp dword [ebp + 0x10], ebx
jne 0x432a64
mov esi, dword [esi]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
call edi
test eax, eax
je 0x4329ef
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
call fcn.00402d80
jmp 0x432a64
push dword [ebp - 0x20]
lea edi, [ebp - 0x10]
push 0x45ee9c
call fcn.004056f0
mov eax, dword [ebp + 0x18]
pop ecx
mov byte [eax], 1
jmp 0x432a63
cmp dword [ebp - 0x1c], 1
jne 0x432a64
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jne 0x432a25
lea ecx, [ebp - 0x10]
call fcn.00402b00
jmp 0x432a64
inc eax
push eax
call fcn.00440a8a
mov esi, dword [esi]
pop ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
push ebx
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
call edi
test eax, eax
jne 0x432a5b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov byte [eax + ecx], bl
push eax
lea ecx, [ebp - 0x10]
call fcn.00402920
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
push dword [ebp - 0x20]
call fcn.0043f4da
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00402810
lea ecx, [ebp - 0x10]
call fcn.004028e0
mov eax, dword [ebp + 8]
call fcn.00444372
ret
Function at 0x432a8a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
call fcn.0043263a
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x432b17
push dword [ebp + 8]
lea edi, [ebp - 8]
mov dword [ebp - 4], ebx
call fcn.004325df
pop ecx
lea ecx, [ebp - 4]
push ecx
push 0x20019
push ebx
push dword [eax]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, edi
call fcn.004028e0
cmp dword [ebp - 4], ebx
je 0x432b17
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [edi]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call esi
cmp dword [ebp - 0x10], 4
jne 0x432b0e
cmp dword [ebp - 8], 4
jne 0x432b0e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push dword [edi]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432f5b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
call fcn.0043263a
mov esi, eax
cmp esi, ebx
je 0x432fcf
push edi
push dword [ebp + 8]
lea edi, [ebp - 8]
mov dword [ebp - 4], ebx
call fcn.004325df
pop ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [eax]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, edi
call fcn.004028e0
pop edi
cmp dword [ebp - 4], ebx
je 0x432fcf
push dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x14]
mov eax, dword [eax]
push dword [ebp + 0x10]
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
sete bl
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x43496c
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x94
lea ebp, [esp - 4]
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 8
mov eax, 0x4559a6
call fcn.004442d3
xor edi, edi
mov dword [ebp - 4], edi
push 0x45e59a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edi
call fcn.00402830
push 0x94
lea eax, [ebp]
push edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x14], 1
call fcn.004424a0
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp + 0x10], 2
jne 0x434a23
mov eax, dword [ebp + 4]
cmp eax, 3
jb 0x434a50
cmp eax, 4
jbe 0x434a1c
cmp eax, 5
je 0x4349f6
cmp eax, 6
jne 0x434a50
push str.vista
jmp 0x434a48
cmp dword [ebp + 8], edi
jne 0x434a02
push str.win2k
jmp 0x434a48
cmp dword [ebp + 8], 1
jne 0x434a0f
push str.winxp
jmp 0x434a48
cmp dword [ebp + 8], 2
jb 0x434a50
push str.win2k3
jmp 0x434a48
push str.winnt
jmp 0x434a48
cmp dword [ebp + 0x10], 1
jne 0x434a50
cmp dword [ebp + 8], 0x5a
jb 0x434a36
push str.winme
jmp 0x434a48
cmp dword [ebp + 8], 0xa
jb 0x434a43
push str.win98
jmp 0x434a48
push str.win95
mov ecx, dword [ebp - 0x10]
call fcn.00402920
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0043ea6a
add ebp, 0x98
leave
ret
Function at 0x434b44
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x64
mov eax, 0x457819
call fcn.004442d3
mov eax, dword [ebp + 0xc]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.00402830
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x434bf6
lea ecx, [ebp + 0xc]
call fcn.00403620
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00402810
mov byte [ebp - 4], 2
push dword [eax]
push 0x1a
push 0x1209
push 0x4625a4
call fcn.00433609
add esp, 0xc
push eax
lea edi, [ebp + 0xc]
call fcn.004056f0
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004028e0
push dword [ebp + 0xc]
push 0xc
push 0x4fd
push 0x4625c0
call fcn.00433609
add esp, 0xc
push eax
push dword [ebp + 8]
call fcn.004357da
add esp, 0xc
mov ecx, edi
call fcn.004028e0
lea eax, [ebp - 0x10]
call fcn.00402e60
mov al, bl
call fcn.00444372
ret
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push ebx
push eax
mov byte [ebp + 0xf], bl
call fcn.004424a0
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x70], edi
cmp byte [ebp + 0x14], bl
jne 0x434c26
xor eax, eax
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], ax
mov esi, 0x8000000
push 0x10
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.004424a0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402810
mov edi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.00434a97
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.004028e0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x434cb6
push dword [ebp + 0x18]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, ebx
jne 0x434ca3
mov byte [ebp + 0xf], 1
cmp dword [ebp + 0x1c], ebx
je 0x434cee
push dword [ebp + 0x1c]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
jmp 0x434cee
cmp eax, 0x102
jne 0x434cee
mov eax, dword [ebp + 0x20]
cmp eax, ebx
je 0x434cee
mov byte [eax], 1
jmp 0x434cee
push 0x17
push 0x28f3
push str._f_P__PE_Z7P___vZ__v80_P_v
call fcn.00433609
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x10]
mov edx, eax
call fcn.0040e600
mov byte [ebp - 4], 6
push dword [eax]
push dword [ebp + 8]
call fcn.00435858
add esp, 0x18
lea ecx, [ebp - 0x1c]
call fcn.004028e0
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x2c], ebx
je 0x434cfe
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x28], ebx
je 0x434d08
push dword [ebp - 0x28]
call esi
lea ecx, [ebp - 0x14]
call fcn.004028e0
mov bl, byte [ebp + 0xf]
jmp 0x434be6

Function at 0x434ddd
Capabilities:
Create directory

Disassembly:
push ecx
and dword [esp], 0
push 0
push 0x434dce
push esi
call fcn.00434d18
mov eax, dword [esi]
add esp, 0xc
cmp dword [eax - 0xc], 0
je 0x434e03
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov eax, esi
pop ecx
ret
Function at 0x434e55
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x108
lea ebp, [esp - 4]
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x108], eax
push 0xc
mov eax, 0x455965
call fcn.00444306
mov eax, dword [ebp + 0x114]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea esi, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edi, ecx
mov byte [ebp], bl
mov dword [ebp - 4], ebx
call fcn.00434ddd
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 0xc], ebx
je 0x434ebf
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
jne 0x434eab
mov eax, 0x4625e8
lea edx, [ebp]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
cmp eax, ebx
jne 0x434ebf
mov byte [ebp], bl
lea ecx, [ebp - 0x14]
call fcn.004028e0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
lea eax, [ebp]
push eax
call fcn.00402830
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x108]
xor ecx, ebp
call fcn.0043ea6a
add ebp, 0x10c
leave
ret
Function at 0x4354b7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xc
call fcn.004402d1
mov esi, eax
pop ecx
test esi, esi
je 0x4354df
lea ecx, [esi + 4]
call fcn.00403620
lea ecx, [esi + 8]
call fcn.00403620
jmp 0x4354e1
xor esi, esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov ecx, edi
mov byte [esi], 0
call fcn.00402d80
push dword [ebp + 0xc]
lea ebx, [esi + 8]
mov ecx, ebx
call fcn.00402d80
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push esi
push 0x43548a
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov al, byte [esi]
mov ecx, ebx
mov byte [ebp - 1], al
call fcn.004028e0
mov ecx, edi
call fcn.004028e0
push esi
call fcn.0043ea5f
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43553e
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x4587fe
call fcn.004442d3
xor edi, edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x13
push 0x173d
push 0x462674
mov dword [ebp - 0x10], edi
call fcn.00433609
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add esp, 0xc
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x435686
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x31
push 0x2936
push 0x462688
mov dword [ebp - 0x10], edi
call fcn.00433609
add esp, 0xc
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x435686
push dword [ebp - 0x10]
call esi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x13
push 0x173d
push 0x462674
mov dword [ebp - 0x10], edi
call fcn.00433609
add esp, 0xc
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x435686
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.00434f9f
pop ecx
mov dword [ebp - 4], edi
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.00402830
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004028e0
push 0xc
push 0xe4b
push 0x4626bc
call fcn.00433609
add esp, 0xc
lea esi, [ebp - 0x14]
call fcn.0040bb00
push edi
push 0x80
push 4
push edi
push 2
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
je 0x43567e
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, esi
call fcn.00402e60
mov al, 1
jmp 0x435688
lea eax, [ebp - 0x14]
call fcn.00402e60
xor al, al
call fcn.00444372
ret
Function at 0x435736
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, eax
mov eax, dword [esi]
push 0
push eax
mov byte [ebp - 1], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
push edi
call fcn.00440a8a
mov esi, dword [esi]
pop ecx
push eax
push edi
push 0
push esi
mov dword [ebp - 8], eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4357af
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x45e5f0
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4357af
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 8]
mov esi, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
mov word [esi], dx
mov edx, dword [ebp + 0xc]
mov word [edx], ax
mov eax, dword [ecx + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov word [edx], cx
mov word [ebx], ax
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.0043f4da
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
test al, al
jne 0x4357d8
mov edx, dword [ebp + 8]
xor ecx, ecx
mov word [edx], cx
mov edx, dword [ebp + 0xc]
mov word [edx], cx
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov word [ebx], cx
leave
ret

Function at 0x4358a4
Capabilities:
Enumerate processes

Disassembly:
push ebx
push esi
mov esi, 0x128
push esi
xor ebx, ebx
push ebx
push edi
call fcn.004424a0
add esp, 0xc
push edi
push dword [esp + 0x10]
mov dword [edi], esi
call sub.KERNEL32.DLL_Process32First
jmp 0x4358db
mov eax, dword [esp + 0x10]
cmp eax, dword [edi + 8]
je 0x4358e1
push edi
push dword [esp + 0x10]
mov dword [edi], esi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4358c6
jmp 0x4358e3
mov bl, 1
pop esi
mov al, bl
pop ebx
ret

Function at 0x435c66
Capabilities:
Get mac address on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2884]
mov eax, 0x2884
call fcn.0044c240
push 0xffffffffffffffff
push 0x4558ef
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x2880], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 4], esi
push 0x45e59a
mov ecx, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.00402830
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, esi
jne 0x435d18
movzx eax, byte [ebp + esi + 0x194]
push eax
push str._02X
lea eax, [ebp - 0x10]
push 4
push eax
call fcn.00440c67
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00402a00
cmp esi, 5
jge 0x435d12
push 0x462754
mov ecx, edi
call fcn.00402a00
inc esi
cmp esi, 6
jl 0x435cda
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x2880]
xor ecx, ebp
call fcn.0043ea6a
add ebp, 0x2884
leave
ret
Function at 0x435d3b
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
sub esp, 0x204
lea ebp, [esp - 4]
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x204], eax
push 0xc
mov eax, 0x4558ae
call fcn.004442d3
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x45e59a
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
call fcn.00402830
push 0x104
lea eax, [ebp + 0x100]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
lea eax, [ebp + 0x100]
push eax
mov byte [ebp + 0x103], bl
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x435dda
push dword [ebp - 0x10]
lea eax, [ebp]
push str.0x_X
push 0x100
push eax
call fcn.00440c67
add esp, 0x10
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00402920
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x204]
xor ecx, ebp
call fcn.0043ea6a
add ebp, 0x208
leave
ret

Function at 0x435e6d
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov byte [ebp - 5], bl
cmp dword [ebp + 8], ebx
je 0x435f05
push 6
push ebx
push dword [ebp + 8]
call fcn.004424a0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
mov dword [ebp - 0xc], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x435f05
call fcn.0044ca90
mov esi, esp
cmp esi, ebx
je 0x435f05
lea eax, [ebp - 0xc]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x435f05
cmp byte [ebp - 5], bl
jne 0x435f05
mov eax, dword [esi + 0x1a0]
cmp eax, 6
je 0x435ede
cmp eax, 9
je 0x435ede
cmp eax, 0xf
jne 0x435eff
cmp dword [esi + 0x190], 6
jne 0x435eff
push 6
lea eax, [esi + 0x194]
push eax
push dword [ebp + 8]
call fcn.00442f70
add esp, 0xc
mov byte [ebp - 5], 1
mov esi, dword [esi]
cmp esi, ebx
jne 0x435ec4
mov al, byte [ebp - 5]
lea esp, [ebp - 0x14]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ea6a
leave
ret
Function at 0x4363a9
Capabilities:
Get user security identifier

Disassembly:
push 0x1c
mov eax, 0x45587a
call fcn.004442d3
mov ebx, ecx
lea ecx, [ebp - 0x24]
call fcn.00403620
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], 8
call fcn.00402b00
mov eax, dword [ebx]
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push eax
push edi
call esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], edi
je 0x43646a
push dword [ebp - 0x10]
call fcn.00440a8a
mov ebx, dword [ebx]
pop ecx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00402e30
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
push ebx
push edi
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
call fcn.0040a190
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
je 0x43645e
push dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
call fcn.00402920
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x436461
mov dword [ebp - 0x14], edi
push dword [ebp - 0x20]
call fcn.0043f4da
pop ecx
cmp dword [ebp - 0x14], edi
jne 0x436475
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp - 0x24]
call fcn.004028e0
cmp dword [ebp - 0x14], 1
sete al
call fcn.00444372
ret