joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424b17
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004b22e0
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x424bf5
test edi, edi
je 0x424bf5
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x104
jl 0x424bf5
push 0x4000
lea eax, [ebp - 0x4004]
push 0
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [ebp - 0x400c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x424bf5
cmp eax, 0x3fff
ja 0x424bf5
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x424bf5
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x4008]
push eax
push 0x525a10
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x424bf5
push ebx
push 0
push edi
call fcn.004f2670
mov ecx, dword [ebp - 0x4008]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [ebx - 1]
push eax
push edi
call fcn.00424ca8
xor eax, eax
add esp, 0x28
inc eax
jmp 0x424bf7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b2162
leave
ret 0xc
Function at 0x427d9a
Capabilities:
Check if file exists
Copy file
Create directory

Disassembly:
push 0x30
mov eax, 0x51bfc8
call fcn.004b21de
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
xor esi, esi
mov dword [ebx + 0x28], 2
lea eax, [ebx + 0x40]
push esi
push dword [eax]
mov dword [ebp - 0x30], eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea ecx, [ebp - 0x1d]
call fcn.00427069
lea ecx, [ebp - 0x1d]
mov dword [ebp - 0x1c], eax
call fcn.00427b9d
lea ecx, [ebp - 0x1d]
mov dword [ebp - 0x18], eax
call fcn.0042797b
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x28], esi
lea esi, [ebx + 0x34]
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x1d]
call fcn.00427d2c
push eax
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.00414b76
mov esi, dword [ebp + ebx*4 - 0x1c]
and dword [ebp - 4], 0
push esi
call fcn.004058a0
add esp, 0x10
lea ecx, [ebp - 0x24]
push eax
push esi
call fcn.0040b866
push esi
push dword [ebp - 0x30]
lea eax, [ebp - 0x28]
push eax
call fcn.00414b76
add esp, 0xc
push dword [ebp - 0x24]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x427ed5
push esi
push dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
push eax
call fcn.00414b76
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0040b46c
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.00405e50
push dword [ebp - 0x24]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x427ed5
lea ecx, [ebp - 0x1d]
call fcn.00427032
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x38]
push eax
call fcn.00414b76
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0040b46c
mov ecx, dword [ebp - 0x38]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.00405e50
push esi
call fcn.004058a0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.0040b866
push dword [ebp - 0x24]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427edf
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call edi
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00405e50
mov ecx, dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00405e50
mov esi, dword [ebp - 0x2c]
inc ebx
cmp ebx, 3
jb 0x427df7
mov ecx, dword [ebp - 0x3c]
call fcn.00428064
xor eax, eax
call fcn.004b2188
ret 4
Function at 0x427f18
Capabilities:
Read .ini file

Disassembly:
push 0x218
mov eax, 0x51c00e
call fcn.004b21de
mov edi, ecx
lea esi, [edi + 0x44]
mov ecx, esi
call fcn.0041caa0
test eax, eax
je 0x42805c
cmp dword [ebp + 0xc], 0
je 0x42805c
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x219]
push dword [edi + 0x38]
push 0x103
push eax
push 0x526268
push 0x5264b0
call fcn.0042731d
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040829f
and dword [ebp - 4], 0
lea eax, [ebp - 0x220]
push eax
mov ecx, esi
call fcn.00424c9c
mov ecx, dword [ebp - 0x220]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00405e50
mov ecx, esi
call fcn.0042162a
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x42803f
lea ecx, [ebp - 0x219]
call fcn.004273f9
push eax
lea eax, [edi + 0x34]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00414b76
add esp, 0xc
lea ecx, [ebp - 0x219]
mov dword [ebp - 4], 1
call fcn.00427d63
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00414b76
add esp, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00424c90
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.00405e50
mov ecx, dword [ebp - 0x220]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00405e50
mov ecx, esi
call fcn.00424a06
test eax, eax
je 0x42805c
lea ecx, [ebp - 0x219]
call fcn.00427251
mov dword [edi + 0x28], 3
call fcn.004b2188
ret 0xc

Function at 0x428064
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [esi + 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x20d]
call fcn.00426ffb
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.004b2162
leave
ret
Function at 0x42afce
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
mov dword [ebp - 0x878], ecx
push edi
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x86d]
call fcn.0042a3f9
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.00409d05
push 0x5264d8
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0042b60d
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42b09c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x42b1c6
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x42b178
mov esi, dword [ebp - 0x86c]
and esi, 0x10
je 0x42b12a
mov ecx, 0x5264e0
lea eax, [ebp - 0x840]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42b0e3
test dx, dx
je 0x42b0df
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42b0e3
add eax, 4
add ecx, 4
test dx, dx
jne 0x42b0bd
xor eax, eax
jmp 0x42b0e8
sbb eax, eax
or eax, 1
test eax, eax
je 0x42b178
mov ecx, 0x5264e4
lea eax, [ebp - 0x840]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42b121
test dx, dx
je 0x42b11d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42b121
add eax, 4
add ecx, 4
test dx, dx
jne 0x42b0fb
xor eax, eax
jmp 0x42b126
sbb eax, eax
or eax, 1
test eax, eax
je 0x42b178
test esi, esi
jne 0x42b178
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x86c]
push eax
push edi
call ebx
test eax, eax
jne 0x42b0a7
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x874]
call fcn.0040829f
lea ecx, [ebp - 0x874]
push ecx
mov ecx, dword [ebp - 0x878]
call fcn.0042b218
mov ecx, dword [ebp - 0x874]
add ecx, 0xfffffff0
call fcn.00405e50
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b2162
leave
ret
Function at 0x42b218
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.004b22e0
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
xor eax, eax
cmp dword [esi - 0xc], eax
je 0x42b2a5
push edi
push 7
pop ecx
lea edi, [ebp - 0x2024]
rep stosd dword es:[edi], eax
push 0x2000
push 0
stosw word es:[edi], ax
lea eax, [ebp - 0x2004]
push eax
mov dword [ebp - 0x2020], 3
call fcn.004f2670
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.004fa8a3
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b2162
leave
ret 4

Function at 0x42b380
Capabilities:
Read .ini file

Disassembly:
push 0x24
mov eax, 0x51c183
call fcn.004b21de
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0x525b60
call fcn.0040ea20
mov ecx, esi
call fcn.0042aeb6
push eax
lea ecx, [ebp - 0x28]
call fcn.0040ea20
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004060a0
push eax
lea ecx, [ebp - 0x30]
call fcn.004056b0
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
push 0x104
cmovae edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00405670
push 0x104
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.00405740
push edi
push 0x104
push esi
push 0x525a98
lea ecx, [ebp - 0x29]
call fcn.0042a430
push eax
lea ecx, [ebp - 0x29]
call fcn.0042ae48
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
call fcn.00409cd9
lea ecx, [ebp - 0x29]
call fcn.0042a668
push eax
lea ecx, [ebp - 0x30]
call fcn.0042b1f4
mov esi, dword [ebp - 0x30]
test eax, eax
je 0x42b442
push 0x5264c4
push esi
call fcn.0042b64c
pop ecx
pop ecx
test eax, eax
jne 0x42b445
xor ebx, ebx
inc ebx
lea ecx, [esi - 0x10]
call fcn.00405e50
lea ecx, [ebp - 0x28]
call fcn.0041176d
mov eax, ebx
call fcn.004b2188
ret
Function at 0x42dd3a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.Wow64RevertWow64Wow64DisableWow6]
lea eax, [ebp - 0x24]
push eax
push 0x1e
push 0x5685e4
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x65527346
mov dword [ebp - 0x10], 0x65726964
mov dword [ebp - 0xc], 0x6f697463
mov word [ebp - 8], 0x6e
call fcn.0040c204
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b2162
leave
ret

Function at 0x42dfc6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x526640]
lea eax, [ebp - 0x24]
push eax
push 0x1f
push 0x5685bc
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x52734634
mov dword [ebp - 0x10], 0x72696465
mov dword [ebp - 0xc], 0x69746365
mov word [ebp - 8], 0x6e6f
mov byte [ebp - 6], 0
call fcn.0040c204
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b2162
leave
ret
Function at 0x42e6b6
Capabilities:
Compare security identifiers

Disassembly:
push 0x34
push 0x553db0
call fcn.004b2730
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], ecx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
mov dword [ecx], ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x42e6ff
cmp dword [ebp - 0x28], ebx
jne 0x42e735
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x42e802
lea eax, [ebp - 0x28]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42e802
cmp dword [ebp - 0x28], 0
je 0x42e802
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x42e802
cmp dword [ebp - 0x2c], eax
jbe 0x42e802
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42e802
push dword [ebp - 0x2c]
call fcn.004fb904
pop ecx
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x42e802
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x2c]
push esi
push 2
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x42e802
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
jne 0x42e802
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x500
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x42e802
cmp dword [ebp - 0x30], 0
je 0x42e802
mov dword [ebp - 0x3c], ebx
cmp ebx, dword [esi]
jae 0x42e802
push dword [ebp - 0x30]
push dword [esi + ebx*8 + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x42e7ec
inc ebx
jmp 0x42e7d1
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [esi + ebx*8 + 8]
shr eax, 2
and eax, ecx
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0042e823
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x42eae7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.004f2670
add esp, 0xc
push esi
call fcn.0042e9fc
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00435c20
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b2162
leave
ret
Function at 0x42eb6a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.004f2670
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ebba
cmp dword [ebp - 0x114], 6
jb 0x42ebba
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b2162
leave
ret

Function at 0x42ec40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x430
push 0x553d70
call fcn.004b2730
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x440], esi
xor ebx, ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
push 0x200
push ebx
lea eax, [ebp - 0x42c]
push eax
call fcn.004f2670
add esp, 0xc
push edi
lea ecx, [ebp - 0x431]
call fcn.0042d7cd
push eax
push 0xff
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
push 0x20219
push ebx
lea eax, [ebp - 0x42c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ed37
mov dword [ebp - 0x43c], ebx
mov edi, 0x210
push edi
push ebx
lea eax, [ebp - 0x22c]
push eax
call fcn.004f2670
add esp, 0xc
mov dword [ebp - 0x438], edi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x43c]
push eax
push ebx
lea ecx, [ebp - 0x432]
call fcn.0042e41e
push eax
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ed37
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp + 0x10], eax
jle 0x42ed37
push dword [ebp + 0x10]
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 4], 0xfffffffe
call fcn.0042ed5d
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42ee25
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x105c
call fcn.004b22e0
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x105c]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x44
pop edi
push edi
push 0
push eax
call fcn.004f2670
add esp, 0xc
mov dword [ebp - 0x105c], edi
lea eax, [ebp - 0x105c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x1030], 1
mov word [ebp - 0x102c], ax
lea edi, [ebp - 0x1018]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x42eee0
push 0x1000
xor edi, edi
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.004f2670
add esp, 0xc
lea ecx, [ebp - 0x1005]
push ebx
push esi
call fcn.0042e2b4
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0042d5fa
add esp, 0x10
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x105c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x1004]
push eax
push edi
jmp 0x42eef8
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x105c]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x42ef1a
push dword [ebp - 0x1014]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1018]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b2162
leave
ret

Function at 0x42ef2b
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
lea ecx, [ebp - 1]
call fcn.0042dd8c
push eax
call fcn.0042e9fc
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042e8ae
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
test eax, eax
je 0x42ef98
push 0x3c
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.004f2670
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x40], 0x440
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x42ef98
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00405e50
mov eax, esi
pop esi
leave
ret
Function at 0x42f16b
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1464
call fcn.004b22e0
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x145c]
push edi
push 0x1458
push 0
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [ebp - 0x145c]
push 0xa2c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x145c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x145d]
call fcn.0042de5d
push eax
lea eax, [ebp - 0x145c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x145d]
call fcn.0042df3d
mov bl, byte [ebp + 0xc]
xor edi, edi
inc edi
test bl, bl
je 0x42f1fe
push edi
push edi
push 0x525a98
push eax
call fcn.0042efa8
add esp, 0x10
lea eax, [ebp - 0x145c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42f22e
lea ecx, [ebp - 0x145d]
call fcn.0042d6fc
test bl, bl
je 0x42f22e
push edi
push edi
push 0x525a98
push eax
call fcn.0042efa8
add esp, 0x10
xor eax, eax
push eax
push edi
push edi
push eax
mov dword [ebp - 0x1464], eax
lea eax, [ebp - 0x1464]
push eax
push dword [esi]
lea eax, [ebp - 0x145c]
push eax
movzx eax, bl
push eax
call fcn.0042b7e5
test eax, eax
jne 0x42f2a4
push str._n__tWinMain:_CreateProcess_fail.__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x145d]
call fcn.0042e27d
test bl, bl
je 0x42f281
push edi
push edi
push 0x525a98
push eax
call fcn.0042efa8
add esp, 0x10
lea ecx, [ebp - 0x145d]
call fcn.0042e01c
test bl, bl
je 0x42f2a0
push edi
push edi
push 0x525a98
push eax
call fcn.0042efa8
add esp, 0x10
xor eax, eax
jmp 0x42f2e4
lea ecx, [ebp - 0x145d]
call fcn.0042de26
test bl, bl
je 0x42f2c3
push edi
push edi
push 0x525a98
push eax
call fcn.0042efa8
add esp, 0x10
lea ecx, [ebp - 0x145d]
call fcn.0042d881
test bl, bl
je 0x42f2e2
push edi
push edi
push 0x525a98
push eax
call fcn.0042efa8
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b2162
leave
ret