joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b4c2
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x583d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x80], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x7c], eax
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x74], edi
test eax, eax
je 0x43b649
test edi, edi
je 0x43b649
lea ecx, [ebp - 0x68]
call fcn.0043b214
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x88]
push ecx
push 4
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x6c], eax
push ecx
push 8
push eax
mov dword [ebp - 0x70], 1
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor ebx, ebx
test eax, eax
je 0x43b63d
cmp dword [ebp - 0x70], 1
je 0x43b55f
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], ebx
push eax
push 1
push 2
push ebx
push 0xb
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x43b63d
cmp dword [esi + 8], ebx
jne 0x43b5dd
push ecx
push ecx
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
call fcn.0043c47e
test al, al
jne 0x43b58d
cmp dword [ebp - 0x70], 1
je 0x43b63d
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43b63d
push 8
xor eax, eax
lea edi, [ebp - 0xa8]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa8], 0x20
cmp dword [eax - 0xc], ebx
jne 0x43b5b7
lea ecx, [ebp - 0x68]
call fcn.0043b36f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
mov edi, dword [ebp - 0x74]
test eax, eax
je 0x43b5dd
mov eax, dword [ebp - 0x8c]
mov dword [esi + 8], eax
push ebx
push dword [ebp - 0x6c]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x43b63d
push dword [ebp - 0x7c]
push edi
push ebx
push dword [ebp - 0x78]
push dword [ebp + 0x18]
push ebx
push ebx
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x70], 1
mov edi, eax
je 0x43b628
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x78]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea ecx, [ebp - 0x68]
call fcn.0043b283
mov al, bl
jmp 0x43b64b
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f225b
mov esp, ebp
pop ebp
ret 0x28
Function at 0x43bb0e
Capabilities:
Acquire debug privileges
Enumerate process modules

Disassembly:
push 0x1c
mov eax, 0x526b98
call fcn.004f22ff
mov edi, ecx
xor esi, esi
mov dword [edi + 0x10], esi
call fcn.0043c453
lea ecx, [ebp - 0x28]
call fcn.004c7ec3
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.004c877a
push str.SeDebugPrivilege
lea ecx, [ebp - 0x28]
call fcn.004c8196
mov eax, 0xc8
push ecx
lea ebx, [eax + 0x14]
mov ecx, edi
push ebx
call fcn.0043c407
movzx eax, al
test eax, eax
je 0x43bbb9
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x10]
push ecx
shl eax, 2
push eax
push dword [edi]
mov dword [ebp - 0x10], esi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x43bb8d
mov eax, dword [ebp - 0x10]
shr eax, 2
cmp ebx, eax
jb 0x43bb4b
push ecx
push eax
mov ecx, edi
call fcn.0043c407
jmp 0x43bbc5
mov ecx, edi
call fcn.0043c453
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x43bbb2
call esi
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x43bbc5
mov esi, 0x80004005
jmp 0x43bbc5
mov ecx, edi
call fcn.0043c453
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004c7f1e
mov eax, esi
call fcn.004f22cd
ret

Function at 0x43bc06
Capabilities:
Acquire debug privileges

Disassembly:
push 0x20
mov eax, 0x526bc3
call fcn.004f22ff
mov ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.004c7ec3
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004c877a
push str.SeDebugPrivilege
lea ecx, [ebp - 0x2c]
call fcn.004c8196
and dword [ebp - 0x10], 0
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0043bbf5
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x43bc6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43bcde
mov edi, 0x80004005
jmp 0x43bce5
cmp dword [ebx + 0x18], 0
mov edi, 0x80004005
jne 0x43bcd4
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x43bc9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43bc9a
call fcn.0043b0ed
jmp 0x43bcaf
mov eax, edi
jmp 0x43bcaf
mov eax, dword [ebx + 0x14]
lea ecx, [ebx + 0x14]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x18], eax
xor eax, eax
test eax, eax
jns 0x43bcd4
mov ecx, dword [ebp + 8]
mov ebx, 0x8000
push ebx
call fcn.0043a522
push ebx
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov ecx, dword [ebp + 8]
push eax
call fcn.0043c298
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43bce5
call fcn.0043b0ed
mov edi, eax
mov byte [ebp - 4], 0
test esi, esi
je 0x43bcf4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004c7f1e
mov eax, edi
call fcn.004f22cd
ret 4
Function at 0x43bd0a
Capabilities:
Acquire debug privileges

Disassembly:
push 0x1c
mov eax, 0x526bee
call fcn.004f22ff
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004c7ec3
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004c877a
push str.SeDebugPrivilege
lea ecx, [ebp - 0x28]
call fcn.004c8196
mov dword [ebp - 0x10], ebx
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0043bbf5
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x43bd84
mov ecx, dword [ebp + 8]
mov edi, 0x8000
push edi
call fcn.0043a522
push edi
push eax
push ebx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov ecx, dword [ebp + 8]
mov edi, eax
push edi
call fcn.0043c298
test edi, edi
jne 0x43bd9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43bd97
call fcn.0043b0ed
mov edi, eax
jmp 0x43bda9
mov edi, 0x80004005
jmp 0x43bda9
push dword [ebp + 8]
call fcn.004c79f8
pop ecx
mov edi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x43bdb7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004c7f1e
mov eax, edi
call fcn.004f22cd
ret 4

Function at 0x43bdcd
Capabilities:
Acquire debug privileges

Disassembly:
push 0x20
mov eax, 0x526c19
call fcn.004f22ff
mov ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.004c7ec3
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004c877a
push str.SeDebugPrivilege
lea ecx, [ebp - 0x2c]
call fcn.004c8196
and dword [ebp - 0x10], 0
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0043bbf5
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x43bebe
cmp dword [ebx + 0x18], 0
jne 0x43be6d
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x43be58
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43be51
call fcn.0043b0ed
mov edi, eax
jmp 0x43be69
mov edi, 0x80004005
jmp 0x43be69
mov eax, dword [ebx + 0x14]
lea ecx, [ebx + 0x14]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
xor edi, edi
mov dword [ebx + 0x18], eax
test edi, edi
js 0x43beda
mov ecx, dword [ebp + 8]
push 0x8000
call fcn.0043a522
cmp dword [ebx + 0x1c], 0
mov edi, eax
jne 0x43bea5
cmp dword [ebx + 0x18], 0
jne 0x43be8c
xor eax, eax
jmp 0x43be9a
push 0x55cb5c
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x1c], eax
test eax, eax
jne 0x43bea5
xor edi, edi
jmp 0x43beb1
push 0x8000
push edi
push esi
call dword [ebx + 0x1c]
mov edi, eax
mov ecx, dword [ebp + 8]
push edi
call fcn.0043c298
test edi, edi
jne 0x43bed8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43bed1
call fcn.0043b0ed
mov edi, eax
jmp 0x43beda
mov edi, 0x80004005
jmp 0x43beda
xor edi, edi
mov byte [ebp - 4], 0
test esi, esi
je 0x43bee9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004c7f1e
mov eax, edi
call fcn.004f22cd
ret 4
Function at 0x43beff
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x526c55
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x583d10]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov eax, dword [0x583d10]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x14]
call fcn.004c7ec3
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x278], ebx
call fcn.004c877a
push str.SeDebugPrivilege
lea ecx, [esp + 0x18]
call fcn.004c8196
call fcn.00437474
push eax
lea ecx, [esp + 0x14]
call fcn.0043a4ef
lea eax, [esp + 0x10]
mov byte [esp + 0x278], 1
push eax
mov ecx, esi
call fcn.0043bc06
test eax, eax
jns 0x43c033
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.0043bdcd
test eax, eax
jns 0x43c033
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x25c], ebx
mov ecx, esi
mov byte [esp + 0x278], 2
call fcn.0043bbf5
push eax
lea ecx, [esp + 0x30]
call fcn.0043c0d2
test eax, eax
jne 0x43bfee
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43c08f
call fcn.0043b0ed
mov esi, eax
jmp 0x43c094
cmp dword [esp + 0x25c], 0
je 0x43c08f
lea eax, [esp + 0x54]
push eax
call fcn.0043a8c3
pop ecx
push eax
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
call fcn.0043a84a
mov byte [esp + 0x278], 1
cmp dword [esp + 0x2c], 0
je 0x43c033
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x10]
call fcn.004c7e0c
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.0043c2e8
mov esi, ebx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00436fdb
or dword [esp + 0x278], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004c7f1e
mov eax, esi
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.004f225b
mov esp, ebp
pop ebp
ret 4
mov esi, 0x80004005
mov byte [esp + 0x278], 1
cmp dword [esp + 0x2c], 0
je 0x43c04a
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x2c], ebx
jmp 0x43c04a
Function at 0x43c0d2
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push 0x18
mov eax, 0x526c8b
call fcn.004f22ff
mov esi, ecx
lea ecx, [ebp - 0x24]
call fcn.004c7ec3
xor ebx, ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.004c877a
push str.SeDebugPrivilege
lea ecx, [ebp - 0x24]
call fcn.004c8196
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x43c138
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43c125
call fcn.0043b0ed
mov edi, eax
jmp 0x43c12a
mov edi, 0x80004005
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004c7f1e
jmp 0x43c150
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
mov dword [esi + 0x230], 1
call fcn.004c7f1e
mov edi, ebx
test edi, edi
js 0x43c1b1
push 0x22c
lea edi, [esi + 4]
push ebx
push edi
call fcn.004f2e30
add esp, 0xc
mov dword [edi], 0x22c
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x43c1a7
mov eax, ebx
cmp dword [esi + 0x230], ebx
je 0x43c184
mov eax, dword [esi + 0xc]
cmp dword [ebp + 8], eax
je 0x43c1bb
push 0x22c
push ebx
push edi
call fcn.004f2e30
add esp, 0xc
mov dword [edi], 0x22c
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [esi + 0x230], eax
test eax, eax
jne 0x43c177
xor eax, eax
call fcn.004f22cd
ret 4
xor eax, eax
inc eax
jmp 0x43c1b3

Function at 0x43c7fb
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key

Disassembly:
push 0x42c
mov eax, 0x526d1c
call fcn.004f2332
mov ebx, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x428], eax
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004f2e30
add esp, 0xc
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x42c], edi
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x434]
mov dword [ebp - 4], edi
call fcn.0043c6fa
test eax, eax
jne 0x43c920
push 0x208
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push edi
push eax
call fcn.004f2e30
add esp, 0xc
mov dword [ebp - 0x438], 0x105
lea eax, [ebp - 0x438]
lea ecx, [ebp - 0x434]
push eax
lea eax, [ebp - 0x424]
push eax
push str.Common_AppData
call fcn.0043c788
lea ecx, [ebp - 0x434]
mov esi, eax
call fcn.0043c6e0
test esi, esi
jne 0x43c8df
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43c8df
test al, 0x10
je 0x43c8df
lea eax, [ebp - 0x424]
jmp 0x43c8fe
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x8023
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x43c920
lea eax, [ebp - 0x218]
push ebx
push eax
push str._s_s
push 0x104
push dword [ebp - 0x428]
call fcn.004f58d0
add esp, 0x14
cmp eax, 0xffffffff
je 0x43c920
xor edi, edi
inc edi
lea ecx, [ebp - 0x434]
call fcn.0043c6e0
mov eax, edi
call fcn.004f22e1
ret
Function at 0x43c933
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push 0x694
mov eax, 0x526d4f
call fcn.004f239e
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x69c], edi
mov dword [ebp - 0x698], edi
mov dword [ebp - 0x694], edi
push 0x20019
push str.SOFTWAREKingsoftKISCommon
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], 1
call fcn.0043c6fa
test eax, eax
jne 0x43cb3c
push 0x62
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.004f2e30
add esp, 0xc
mov dword [ebp - 0x6a0], 0x32
lea eax, [ebp - 0x6a0]
lea ecx, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x78]
push eax
push str.Lang
call fcn.0043c788
test eax, eax
je 0x43c9da
lea ecx, [ebp - 0x69c]
call fcn.0043c6e0
lea ecx, [ebp - 0x69c]
call fcn.0043c6e0
xor eax, eax
jmp 0x43cb4a
xor eax, eax
push 0x206
mov word [ebp - 0x690], ax
lea eax, [ebp - 0x68e]
push edi
push eax
call fcn.004f2e30
add esp, 0xc
mov dword [ebp - 0x6a0], 0x104
lea eax, [ebp - 0x6a0]
lea ecx, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x690]
push eax
push str.ProgramPath
call fcn.0043c788
lea ecx, [ebp - 0x69c]
mov esi, eax
call fcn.0043c6e0
test esi, esi
jne 0x43c9c8
xor eax, eax
push 0x206
mov word [ebp - 0x280], ax
lea eax, [ebp - 0x27e]
push edi
push eax
call fcn.004f2e30
lea ecx, [ebp - 0x280]
mov esi, edi
lea edi, [ebp - 0x690]
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x43ca82
movzx eax, word [edi + ecx]
test ax, ax
je 0x43ca82
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x43ca66
test edx, edx
jne 0x43ca8e
sub ecx, 2
mov esi, 0x8007007a
xor eax, eax
mov word [ecx], ax
test esi, esi
js 0x43c9c8
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x280]
push str.ressrc
push eax
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x280]
push eax
call esi
push str.uplive.svr
lea eax, [ebp - 0x280]
push eax
call esi
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43c9c8
test al, 0x10
jne 0x43c9c8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x488], ax
lea eax, [ebp - 0x486]
push eax
call fcn.004f2e30
add esp, 0xc
lea eax, [ebp - 0x280]
push eax
push 0x104
lea eax, [ebp - 0x488]
push eax
push 0x55b26c
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x488]
mov ecx, ebx
push eax
call fcn.00417390
lea ecx, [ebp - 0x69c]
call fcn.0043c6e0
xor eax, eax
inc eax
call fcn.004f22f0
ret
Function at 0x43d13d
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x583d10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x270], ax
mov edi, ecx
lea eax, [ebp - 0x26e]
push ebx
push eax
call fcn.004f2e30
add esp, 0xc
lea eax, [ebp - 0x270]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x43d19b
lea edx, [ebp - 0x270]
mov ecx, str.productidinfo.ini
call fcn.00437305
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43d203
test al, 0x10
jne 0x43d203
push esi
lea eax, [ebp - 0x270]
push eax
push ebx
push 0x55ced8
push str.productidinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
xor eax, eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push ebx
push eax
call fcn.004f2e30
push esi
push 0x55cc08
lea eax, [ebp - 0x68]
push 0x32
push eax
call fcn.004378c6
add esp, 0x1c
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.00417390
xor eax, eax
inc eax
pop esi
jmp 0x43d205
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004f225b
mov esp, ebp
pop ebp
ret

Function at 0x43d3cb
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x583d10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004f2e30
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push esi
push 0x55cc08
movzx edi, ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004378c6
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x20c]
add esp, 0x10
push dword [ebx]
push eax
push str.SystemDefaultUILanguage
push str.SystemInfo
call esi
push edi
push 0x55cc08
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004378c6
add esp, 0x10
lea eax, [ebp - 0x20c]
push dword [ebx]
push eax
push str.UserDefaultUILanguage
push str.SystemInfo
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f225b
mov esp, ebp
pop ebp
ret
Function at 0x43d488
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x583d10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
lea eax, [ebp - 0x24c]
mov edi, ecx
push 0
push eax
call fcn.004f2e30
xor eax, eax
mov dword [ebp - 0x250], 0x40
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004f2e30
add esp, 0x18
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x244]
shrd ecx, eax, 0x14
push ecx
mov ecx, dword [ebp - 0x240]
shr eax, 0x14
mov eax, dword [ebp - 0x23c]
shrd ecx, eax, 0x14
push ecx
shr eax, 0x14
push str._d_MB____d_MB__free_total_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004378c6
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x210]
add esp, 0x14
mov ebx, str.SystemInfo
push dword [edi]
push eax
push str.global_physical_memory
push ebx
call esi
mov ecx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x234]
shrd ecx, eax, 0x14
push ecx
mov ecx, dword [ebp - 0x230]
shr eax, 0x14
mov eax, dword [ebp - 0x22c]
shrd ecx, eax, 0x14
push ecx
shr eax, 0x14
push str._d_MB____d_MB__free_total_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004378c6
add esp, 0x14
lea eax, [ebp - 0x210]
push dword [edi]
push eax
push str.global_pageFile_memory
push ebx
call esi
mov ecx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x224]
shrd ecx, eax, 0x14
push ecx
mov ecx, dword [ebp - 0x220]
shr eax, 0x14
mov eax, dword [ebp - 0x21c]
shrd ecx, eax, 0x14
push ecx
push str._d_MB____d_MB__free_total_
shr eax, 0x14
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004378c6
add esp, 0x14
lea eax, [ebp - 0x210]
push dword [edi]
push eax
push str.global_virtual_memory
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f225b
mov esp, ebp
pop ebp
ret
Function at 0x43d5f7
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x165c
call fcn.004f5c90
mov eax, dword [0x583d10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1658]
mov dword [ebp - 0x1654], ecx
push eax
push 0x1000
lea eax, [ebp - 0x1620]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x43d7cb
mov ebx, dword [ebp - 0x1658]
xor eax, eax
shr ebx, 2
mov dword [ebp - 0x164c], eax
test ebx, ebx
je 0x43d7cb
mov ecx, dword [ebp + eax*4 - 0x1620]
mov dword [ebp - 0x1650], ecx
test ecx, ecx
je 0x43d7bc
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x1fc]
mov esi, str._unknown_
lea edi, [ebp - 0x210]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.004f2e30
add esp, 0xc
push dword [ebp - 0x1650]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x43d7b6
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x43d7af
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x1644]
push 0x28
rep stosd dword es:[edi], eax
pop eax
push eax
mov dword [ebp - 0x1648], eax
lea eax, [ebp - 0x1648]
push eax
push esi
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x43d74c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.004f2e30
mov eax, dword [ebp - 0x1640]
mov edi, 0x104
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x163c]
shr eax, 0x14
push eax
push str.___d_MB__d_MB_
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.004378c6
add esp, 0x20
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.0043d234
jmp 0x43d751
mov edi, 0x104
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
call fcn.004f2e30
mov eax, dword [ebp - 0x164c]
push dword [ebp + eax*4 - 0x1620]
lea eax, [ebp - 0x620]
push str.running_process__d
push edi
push eax
call fcn.004378c6
mov eax, dword [ebp - 0x1654]
add esp, 0x1c
push dword [eax]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push eax
push str.SystemInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x164c]
inc eax
mov dword [ebp - 0x164c], eax
cmp eax, ebx
jb 0x43d651
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f225b
mov esp, ebp
pop ebp
ret
Function at 0x43dcc6
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
mov eax, dword [0x583d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004f2e30
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.004373fe
mov edi, eax
cmp edi, 0xffffffff
je 0x43ddab
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x43ddab
push ebx
push 0x55d13c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x43ddaa
push edi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x43ddaa
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call ebx
test eax, eax
je 0x43dda3
push 0x2b0
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x4c0], esi
push esi
push eax
call fcn.004f2e30
add esp, 0xc
lea eax, [ebp - 0x4c0]
push 0x100
push 0x2b4
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
cmovne esi, dword [ebp - 0x4c0]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004f225b
mov esp, ebp
pop ebp
ret