joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424aed
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa88], ecx
mov ecx, dword [ebp + 0x18]
push edi
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa8c], edx
test esi, esi
je 0x424d12
test eax, eax
jne 0x424b3e
test ecx, ecx
je 0x424d12
movzx eax, word [esi + 2]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp ax, 0x3a
je 0x424b94
cmp ax, 0x5c
je 0x424b94
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.00492360
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 0x828]
push eax
call edi
lea esi, [ebp - 0x828]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x424d12
test al, 0x10
je 0x424d12
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x418]
push eax
call ebx
push 0x4bd624
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa90], eax
cmp eax, 0xffffffff
je 0x424d12
mov dword [ebp - 0xa7c], 1
push 0x4bd628
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x424cd7
push 0x4bd62c
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x424cd7
cmp dword [ebp - 0xa78], 0xffffffff
je 0x424cd7
push esi
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
test byte [ebp - 0xa78], 0x10
je 0x424cb7
cmp dword [ebp - 0xa80], 0
je 0x424c7b
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x210]
push eax
call dword [ebp - 0xa80]
test eax, eax
je 0x424cf4
cmp dword [ebp + 0xc], 0
je 0x424cd7
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x210]
push dword [ebp - 0xa80]
push dword [ebp - 0xa88]
push dword [ebp - 0xa84]
push dword [ebp + 0xc]
push eax
call fcn.00424aed
push 2
pop ecx
cmp eax, ecx
jne 0x424cd7
mov dword [ebp - 0xa7c], ecx
jmp 0x424cfe
cmp dword [ebp - 0xa84], 0
je 0x424cd7
push dword [ebp - 0xa88]
lea eax, [ebp - 0x210]
push eax
call dword [ebp - 0xa84]
test eax, eax
je 0x424cf4
lea eax, [ebp - 0xa78]
push eax
push dword [ebp - 0xa90]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x424bf7
jmp 0x424cfe
mov dword [ebp - 0xa7c], 2
push dword [ebp - 0xa90]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0xa7c]
jmp 0x424d14
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ff11
leave
ret 0x18
Function at 0x424d25
Capabilities:
Enumerate files on windows

Disassembly:
push 0x6c0
mov eax, 0x4ac6e5
call fcn.0049174a
mov ebx, dword [ebp + 8]
and dword [ebp - 0x67c], 0
lea eax, [ebp - 0x6a4]
mov edi, ecx
push eax
mov dword [ebp - 0x680], ebx
mov dword [ebp - 0x684], edi
call fcn.004055c3
xor esi, esi
inc esi
mov dword [ebp - 4], esi
test edi, edi
jne 0x424d8c
lea eax, [ebp - 0x6a4]
push eax
push ebx
call fcn.00413439
lea eax, [ebp - 0x6a4]
push eax
mov dword [ebp - 0x67c], esi
mov byte [ebp - 4], 0
call fcn.0040d485
mov eax, ebx
jmp 0x424eb8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x21c]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str..________.dirty
lea eax, [ebp - 0x21c]
push eax
call ebx
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x678], eax
cmp eax, 0xffffffff
je 0x424e8a
push 0x4bd628
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x424e63
push 0x4bd62c
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x424e63
cmp dword [ebp - 0x674], 0xffffffff
je 0x424e63
push dword [ebp - 0x684]
lea eax, [ebp - 0x424]
push eax
call edi
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x424]
push eax
call ebx
lea eax, [ebp - 0x424]
push eax
lea esi, [ebp - 0x6c0]
call fcn.00402703
mov eax, esi
push eax
lea eax, [ebp - 0x6cc]
push eax
lea eax, [ebp - 0x6a4]
push eax
mov byte [ebp - 4], 2
call fcn.0040d4ad
push 0
push 1
mov byte [ebp - 4], 1
call fcn.00402bb8
xor esi, esi
inc esi
lea eax, [ebp - 0x674]
push eax
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x424dd3
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x6a4]
push eax
push dword [ebp - 0x680]
call fcn.00413439
lea eax, [ebp - 0x6a4]
push eax
mov dword [ebp - 0x67c], esi
mov byte [ebp - 4], 0
call fcn.0040d485
mov eax, dword [ebp - 0x680]
call fcn.004917cd
ret
Function at 0x424f01
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
cmp edi, ebx
je 0x424ffb
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x424ffb
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00492360
add esp, 0xc
lea esi, [ebp - 0x210]
mov ecx, edi
call fcn.00425b95
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x424f78
shr eax, 4
not eax
and eax, 1
jmp 0x424ffd
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [ebp - 0x418]
call fcn.0042500b
test eax, eax
je 0x424ffb
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x10000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x424fdd
mov dword [ebp - 0x41c], 1
cmp eax, 0xffffffff
jne 0x424fe3
mov dword [ebp - 0x41c], ebx
lea eax, [ebp - 0x420]
call fcn.004011d5
xor eax, eax
cmp byte [ebp - 0x41c], bl
setne al
jmp 0x424ffd
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ff11
leave
ret
Function at 0x42535c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x4253c2
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00492360
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4253c2
push esi
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x4253c2
xor eax, eax
inc eax
jmp 0x4253c4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ff11
leave
ret
Function at 0x4253d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.0049bf00
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x201c], eax
mov dword [ebp - 0x2020], ebx
cmp edi, ebx
je 0x4255ae
cmp eax, ebx
je 0x4255ae
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x425428
mov dword [ebp - 0x2020], 1
jmp 0x4255ae
push ebx
push ebx
push 3
push ebx
push ebx
mov esi, SysReAllocString
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
call edi
push ebx
push ebx
push 3
push ebx
push ebx
push esi
push dword [ebp - 0x201c]
mov dword [ebp - 0x2010], eax
call edi
mov esi, dword [ebp - 0x2010]
mov dword [ebp - 0x2014], eax
cmp esi, ebx
je 0x425598
cmp esi, 0xffffffff
je 0x425598
cmp eax, ebx
je 0x425598
cmp eax, 0xffffffff
je 0x425598
xor eax, eax
mov dword [ebp - 0x2034], ebx
lea edi, [ebp - 0x2030]
stosd dword es:[edi], eax
mov dword [ebp - 0x202c], ebx
lea edi, [ebp - 0x2028]
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
lea eax, [ebp - 0x2034]
push eax
push esi
call edi
test eax, eax
je 0x425598
lea eax, [ebp - 0x202c]
push eax
push dword [ebp - 0x2014]
call edi
test eax, eax
je 0x425598
mov eax, dword [ebp - 0x2034]
cmp eax, dword [ebp - 0x202c]
jne 0x425598
mov eax, dword [ebp - 0x2030]
cmp eax, dword [ebp - 0x2028]
jne 0x425598
push ebx
lea eax, [ebp - 0x2018]
push eax
push 0x1000
lea eax, [ebp - 0x200c]
push eax
mov dword [ebp - 0x2018], ebx
push esi
jmp 0x425582
cmp dword [ebp - 0x2018], ebx
je 0x42558e
push ebx
lea eax, [ebp - 0x201c]
push eax
push dword [ebp - 0x2018]
lea eax, [ebp - 0x100c]
push eax
push dword [ebp - 0x2014]
mov dword [ebp - 0x201c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425598
mov ecx, dword [ebp - 0x2018]
cmp ecx, dword [ebp - 0x201c]
jne 0x425598
lea edi, [ebp - 0x100c]
lea esi, [ebp - 0x200c]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x425564
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x425598
push ebx
lea eax, [ebp - 0x2018]
push eax
push 0x1000
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 0x2010]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42550c
jmp 0x425598
mov dword [ebp - 0x2020], 1
lea eax, [ebp - 0x2014]
call fcn.004011d5
lea eax, [ebp - 0x2010]
call fcn.004011d5
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x2020]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ff11
leave
ret 4

Function at 0x4255c5
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4255dc
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
ret
test al, 1
je 0x4255eb
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret
Function at 0x42567f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x425695
xor eax, eax
jmp 0x4256a8
or eax, dword [esp + 0xc]
not esi
and eax, esi
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret 8

Function at 0x42575d
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x425789
call fcn.00424f01
test eax, eax
jne 0x425789
pop edi
pop esi
pop ebx
leave
ret 0xc
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, ebx
je 0x4257a9
cmp esi, 0xffffffff
jne 0x4257c1
cmp dword [ebp - 8], ebx
jne 0x4257b5
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xc]
call fcn.004011d5
mov eax, ebx
jmp 0x425782
mov edi, dword [ebp + 0x10]
push ebx
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4257e5
cmp dword [ebp - 4], edi
jne 0x4257e5
xor ebx, ebx
inc ebx
jmp 0x4257b5
cmp dword [ebp - 8], ebx
jne 0x4257b5
or dword [ebp - 0xc], 0xffffffff
cmp esi, 0xffffffff
je 0x4257fe
cmp esi, ebx
je 0x4257fe
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
jmp 0x4257af

Function at 0x425803
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x42582b
push esi
mov edx, dword [esp + 8]
movzx edx, byte [ecx + edx]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4dfba0]
inc ecx
cmp ecx, dword [esp + 0xc]
jl 0x42580c
pop esi
not eax
ret 8
Function at 0x425c44
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp + 0x19c], eax
push ebx
mov ebx, dword [ebp + 0x1a8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], ebx
test edi, edi
je 0x425d1e
test ebx, ebx
je 0x425d1e
mov esi, str.deviceMup_
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, edi
jne 0x425ca3
push ebx
push 0x4bd6f0
push esi
push edi
call fcn.0042778f
xor eax, eax
inc eax
jmp 0x425d20
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x80], eax
xor ebx, ebx
xor eax, eax
inc eax
mov ecx, ebx
shl eax, cl
mov ecx, dword [ebp - 0x80]
test ecx, eax
je 0x425d18
push 0x3a
lea eax, [ebx + 0x61]
mov word [ebp + 0x194], ax
pop eax
mov word [ebp + 0x196], ax
xor eax, eax
push 0x206
lea edi, [ebp + 0x198]
push eax
stosd dword es:[edi], eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.00492360
add esp, 0xc
push 0x104
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jbe 0x425d18
push dword [ebp - 0x78]
lea esi, [ebp - 0x74]
call fcn.0042788c
test eax, eax
jne 0x425d3a
inc ebx
cmp ebx, 0x1a
jl 0x425cae
xor eax, eax
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ff11
add ebp, 0x1a0
leave
ret 4
push dword [ebp - 0x7c]
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
jmp 0x425c99

Function at 0x4265cf
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x4dd070]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.00426fa9
push esi
test eax, eax
je 0x42665c
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00492360
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x426653
cmp esi, 0xffffffff
je 0x426653
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x42664f
push edi
lea eax, [esp + 0xc]
push eax
call fcn.00426fa9
test eax, eax
je 0x426653
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x426635
lea eax, [esp + 4]
call fcn.004011d5
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.0048ff11
mov esp, ebp
pop ebp
ret 4
Function at 0x426671
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 8
mov eax, 0x4a90ba
call fcn.004916e1
mov eax, dword [ebp + 0x238]
mov dword [ebp - 0x14], eax
test edi, edi
je 0x426706
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x4266fe
cmp esi, 0xffffffff
je 0x4266fe
push 0x228
lea eax, [ebp + 4]
push 0
push eax
mov dword [ebp], 0x22c
call fcn.00492360
add esp, 0xc
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4266fa
push dword [ebp - 0x14]
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x4266fe
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4266e3
lea eax, [ebp - 0x10]
call fcn.004011d5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.0048ff11
add ebp, 0x230
leave
ret 4

Function at 0x42672b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x42673e
xor eax, eax
jmp 0x426797
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.00492360
mov dword [ebp - 0x14], esi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
add esp, 0xc
call fcn.00424ab3
mov edi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42678f
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00424ae0
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x426a8b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x426aa4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.004269b0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov edi, 0x426ba0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00426671
cmp dword [ebp - 0x14], esi
je 0x426a9b
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x426ae0
cmp eax, 0xffffffff
jne 0x426aec
lea eax, [ebp - 0x10]
call fcn.004011d5
mov eax, esi
jmp 0x426a9d
lea ecx, [ebp - 8]
push ecx
push 0xf01ff
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x426ae0
push esi
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x426b96
mov edi, dword [ebp + 8]
call fcn.00424ab3
push 0x40
mov dword [ebp + 8], eax
lea eax, [ebp - 0x70]
push esi
push eax
mov dword [ebp - 0x74], 0x44
call fcn.00492360
add esp, 0xc
push 5
pop eax
mov word [ebp - 0x44], ax
xor eax, eax
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x48], 1
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x426b85
push dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
call ebx
push dword [ebp + 8]
call fcn.00424ae0
push dword [ebp - 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 8]
call ebx
jmp 0x426ae0

Function at 0x426d55
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp - 4], eax
test edi, edi
jne 0x426d7c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ff11
leave
ret 4
push esi
push dword [ebp + 8]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
je 0x426d9e
cmp esi, 0xffffffff
jne 0x426db0
xor esi, esi
lea eax, [ebp - 0x210]
call fcn.004011d5
mov eax, esi
pop esi
jmp 0x426d6e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00492360
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jbe 0x426d9e
push edi
lea ecx, [ebp - 0x20c]
call fcn.00425c44
xor esi, esi
inc esi
jmp 0x426da0
Function at 0x4270b4
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
or dword [esi], 0xffffffff
push ebx
push dword [esp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427149
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x427149
push edi
lea edi, [esi + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x427148
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov edx, ecx
or edx, eax
je 0x427148
cmp eax, ebx
jl 0x42711d
mov eax, 0x400000
jg 0x427119
cmp ecx, eax
jbe 0x42711d
mov edi, eax
jmp 0x42711f
mov edi, ecx
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi]
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x427148
push dword [esi + 0x18]
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop ebx
ret 4

Function at 0x427ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x20
mov eax, 0x4ab213
call fcn.004916e1
mov eax, dword [ebp + 0x80c]
mov ebx, dword [ebp + 0x810]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x814]
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], ebx
mov word [esi + 4], ax
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], edi
cmp ebx, edi
je 0x427bc2
push 0x7fe
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call fcn.00492360
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], edi
push ebx
push dword [ebp - 0x20]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x18], edi
call ebx
cmp dword [ebp - 0x18], 1
je 0x427b5c
cmp dword [ebp - 0x18], 2
jne 0x427bc2
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x427bc2
cmp eax, 0x800
jbe 0x427b90
add eax, 2
push eax
call fcn.00490962
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
push edi
push eax
mov dword [ebp - 0x14], eax
call fcn.00492360
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
jmp 0x427b98
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call ebx
mov ebx, dword [ebp - 0x14]
mov eax, ebx
cmp ebx, edi
jne 0x427bb0
lea eax, [ebp]
push eax
push esi
call fcn.00402b91
cmp ebx, edi
je 0x427bc2
push ebx
call fcn.00490885
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0048ff11
add ebp, 0x804
leave
ret