joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dd80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x47ca30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x41dedd
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.004140d0
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x260]
mov dword [ebp - 0x220], 0
push eax
call fcn.00414e30
push 1
push 0
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0
push eax
lea ecx, [ebp - 0x230]
call fcn.00414f50
cmp eax, 0xffffffff
je 0x41de2b
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x230]
call fcn.00415be0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.004187b0
cmp esi, eax
je 0x41de4d
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00414e30
cmp dword [ebp - 0x234], 8
jb 0x41de64
push dword [ebp - 0x248]
call fcn.0045ad4d
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x41de98
push dword [ebp - 0x230]
call fcn.0045ad4d
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x24c], 8
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
jb 0x41decc
push dword [ebp - 0x260]
call fcn.0045ad4d
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
Function at 0x41def0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x47ca30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x41df61
cmp word [ebp - 0x210], 0
je 0x41df61
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.004140d0
lea eax, [ebp - 0x228]
mov ecx, esi
push eax
call fcn.00417ce0
cmp dword [ebp - 0x214], 8
jb 0x41e07f
push dword [ebp - 0x228]
jmp 0x41e077
xor eax, eax
mov dword [ebp - 0x22c], 7
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
call fcn.0041dd80
test al, al
je 0x41dfb6
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x240]
push eax
call fcn.00414e30
jmp 0x41e068
push 3
xor eax, eax
mov dword [ebp - 0x214], 7
push 0x40dd50
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
call fcn.00415a10
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.00414e30
push 1
push 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
mov ecx, esi
call fcn.00414f50
cmp eax, 0xffffffff
je 0x41e034
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00415be0
cmp dword [ebp - 0x214], 8
jb 0x41e04b
push dword [ebp - 0x228]
call fcn.0045ad4d
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
cmp dword [ebp - 0x22c], 8
jb 0x41e07f
push dword [ebp - 0x240]
call fcn.0045ad4d
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
Function at 0x41e090
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x47ca30]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
mov dword [ebp - 0x54], eax
xor eax, eax
push edi
mov dword [ebp - 0x58], edx
xor edi, edi
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
jmp 0x41e0d0
xor eax, eax
mov dword [ebp - 0xc], 7
push 0xffffffffffffffff
push eax
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
call fcn.00414e30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x50]
call fcn.0041ed60
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x20]
call fcn.00414d60
cmp dword [ebp - 0x3c], 8
jb 0x41e121
push dword [ebp - 0x50]
call fcn.0045ad4d
add esp, 4
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmovae ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x20]
cmovae ecx, dword [ebp - 0x20]
test eax, eax
je 0x41e141
sub eax, ecx
sar eax, 1
push 0x5f
push 1
push eax
lea ecx, [ebp - 0x20]
call fcn.00415b10
mov edi, edi
lea ecx, [ebp - 0x64]
call fcn.0042d8e0
cmp dword [ebp - 0x60], 0xffffffff
ja 0x41e150
mov edx, dword [ebp - 0x64]
jb 0x41e16b
cmp edx, 0xffff7fff
ja 0x41e150
and edx, 0x7fff
lea ecx, [ebp - 0x50]
call fcn.0041ed60
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x20]
call fcn.00414d60
cmp dword [ebp - 0x3c], 8
jb 0x41e19a
push dword [ebp - 0x50]
call fcn.0045ad4d
add esp, 4
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00418490
lea ecx, [ebp - 0x38]
cmp ecx, eax
je 0x41e1bb
push 0xffffffffffffffff
push 0
push eax
call fcn.00414e30
cmp dword [ebp - 0x3c], 8
jb 0x41e1cc
push dword [ebp - 0x50]
call fcn.0045ad4d
add esp, 4
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push 0
cmovae eax, dword [ebp - 0x38]
push eax
call ebx
test eax, eax
jne 0x41e202
cmp dword [ebp - 0xc], 8
jb 0x41e1f1
push dword [ebp - 0x20]
call fcn.0045ad4d
add esp, 4
mov edx, dword [ebp - 0x58]
inc edi
cmp edi, 0x32
jl 0x41e0d0
xor bl, bl
jmp 0x41e22b
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x38]
cmp eax, ecx
je 0x41e218
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00414e30
cmp dword [ebp - 0xc], 8
jb 0x41e229
push dword [ebp - 0x20]
call fcn.0045ad4d
add esp, 4
mov bl, 1
cmp dword [ebp - 0x24], 8
jb 0x41e23c
push dword [ebp - 0x38]
call fcn.0045ad4d
add esp, 4
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
Function at 0x41e250
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x47ca30]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x41e27f
mov ebx, dword [edi]
jmp 0x41e281
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e2c3
test al, 0x10
je 0x41e2a5
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x41e2af
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.004182b0
cmp dword [edi + 0x14], 8
jb 0x41e2d9
mov eax, dword [edi]
jmp 0x41e2db
mov eax, edi
push dword [edi + 0x10]
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push 0
call fcn.00415c90
test eax, eax
jne 0x41e300
test esi, esi
je 0x41e34b
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x41e351
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0041e250
add esp, 8
test al, al
jne 0x41e316
xor bl, bl
jmp 0x41e351
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41e34f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x41e33e
mov ecx, edi
call fcn.0041dd60
test al, al
jne 0x41e34f
test esi, esi
je 0x41e34b
mov ecx, ebx
call fcn.00425480
mov dword [esi], eax
xor bl, bl
jmp 0x41e351
mov bl, 1
cmp dword [esp + 0x28], 8
jb 0x41e364
push dword [esp + 0x14]
call fcn.0045ad4d
add esp, 4
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret

Function at 0x41e5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [esp + 8], 0
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0xc]
jb 0x41e5d3
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
test eax, eax
je 0x41e612
cmp eax, 0xffffffff
je 0x41e612
push 0
lea ecx, [esp + 0x10]
mov esi, eax
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41e612
mov edi, dword [esp + 0xc]
cmp edi, ebx
je 0x41e615
or edi, 0xffffffff
test esi, esi
je 0x41e629
cmp esi, 0xffffffff
je 0x41e629
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41e632
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00426870
int3
Function at 0x41e640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [esp + 8], 0
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0xc]
jb 0x41e663
mov eax, dword [eax]
push 0
push 0
push 3
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
test eax, eax
je 0x41e69f
cmp eax, 0xffffffff
je 0x41e69f
push 0
lea ecx, [esp + 0x10]
mov esi, eax
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41e69f
mov edi, dword [esp + 0xc]
cmp edi, ebx
je 0x41e6a2
or edi, 0xffffffff
test esi, esi
je 0x41e6b6
cmp esi, 0xffffffff
je 0x41e6b6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41e6bf
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00426870
int3

Function at 0x41e6d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47ca30]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x41e7c9
cmp eax, 0x104
ja 0x41e7c9
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x240]
call fcn.004140d0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x258]
call fcn.00417ce0
mov ecx, eax
call fcn.004187b0
cmp esi, eax
je 0x41e756
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00414e30
cmp dword [ebp - 0x214], 8
jb 0x41e76d
push dword [ebp - 0x228]
call fcn.0045ad4d
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
cmp dword [ebp - 0x244], 8
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
jb 0x41e7a1
push dword [ebp - 0x258]
call fcn.0045ad4d
add esp, 4
cmp dword [ebp - 0x22c], 8
jb 0x41e7b8
push dword [ebp - 0x240]
call fcn.0045ad4d
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
Function at 0x4216c0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.0045bf30
mov eax, dword [0x47ca30]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x421807
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x421794
cmp word [esp + 0x10], ax
jne 0x421758
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.00415a10
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421760
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00415a10
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x421802
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x4217e7
cmp eax, 0x400
ja 0x4217e7
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.004189b0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret 8
Function at 0x4228f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10014
call fcn.0045bf30
mov eax, dword [0x47ca30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov esi, ecx
test edi, edi
je 0x422927
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x422922
mov eax, dword [edi]
jmp 0x422924
mov eax, edi
mov byte [eax], 0
call fcn.00418810
test al, al
je 0x422942
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
push 0x40df90
push esi
call fcn.0041e4b0
add esp, 8
mov dword [ebp - 0x1000c], eax
test eax, eax
je 0x422930
push ebx
push eax
push 0x10000
lea eax, [ebp - 0x10004]
mov byte [ebp - 0x10005], 1
push 1
push eax
xor ebx, ebx
call fcn.00461088
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10010], esi
test esi, esi
je 0x4229fc
mov eax, dword [ebp + 8]
lea ebx, [ebx]
test edi, edi
je 0x4229c0
sub eax, ebx
lea edx, [ebp - 0x10010]
cmp eax, esi
mov dword [ebp - 0x10014], eax
lea ecx, [ebp - 0x10014]
cmovae ecx, edx
lea eax, [ebp - 0x10004]
push dword [ecx]
mov ecx, edi
push eax
call fcn.004149f0
mov eax, dword [ebp + 8]
sub eax, ebx
cmp eax, esi
jb 0x4229f5
push dword [ebp - 0x1000c]
lea eax, [ebp - 0x10004]
add ebx, esi
push 0x10000
push 1
push eax
call fcn.00461088
mov esi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10010], esi
test esi, esi
jne 0x422990
jmp 0x4229fc
mov byte [ebp - 0x10005], 0
push dword [ebp - 0x1000c]
call fcn.004611a0
mov ecx, dword [ebp - 4]
add esp, 4
mov al, byte [ebp - 0x10005]
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
Function at 0x4248d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x494
mov eax, dword [0x47ca30]
xor eax, esp
mov dword [esp + 0x490], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
push 2
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x1a], 1
mov dword [esp + 0x248], 0x40e2fc
mov byte [esp + 0x250], bl
mov dword [esp + 0x480], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esp + 0x244], eax
lea ecx, [esp + 0x47c]
xor eax, eax
mov dword [esp + 0x240], 0x40e224
push 0xffffffffffffffff
push eax
push esi
mov dword [esp + 0x49c], 7
mov dword [esp + 0x498], ebx
mov word [esp + 0x488], ax
call fcn.00414e30
lea ecx, [esp + 0x240]
call fcn.0042b030
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x424a16
jmp 0x424980
push dword [eax + 8]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4249ab
test bl, 1
je 0x4249a7
lea ecx, [esp + 0x18]
and ebx, 0xfffffffe
call fcn.0041a4c0
xor al, al
jmp 0x4249fe
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
mov byte [esp + 0x13], al
test al, al
je 0x4249e3
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4249f7
test bl, 2
je 0x4249f7
and ebx, 0xfffffffd
lea ecx, [esp + 0x188]
jmp 0x4249f2
test bl, 4
je 0x4249f7
and ebx, 0xfffffffb
lea ecx, [esp + 0xd0]
call fcn.0041a4c0
push esi
call edi
mov al, byte [esp + 0x13]
and byte [esp + 0x12], al
lea ecx, [esp + 0x240]
call fcn.0042b030
test eax, eax
jne 0x424980
cmp dword [esp + 0x490], 8
mov dword [esp + 0x240], 0x40e224
jb 0x424a3a
push dword [esp + 0x47c]
call fcn.0045ad4d
add esp, 4
push dword [esp + 0x244]
xor eax, eax
mov dword [esp + 0x494], 7
mov dword [esp + 0x490], 0
mov word [esp + 0x480], ax
mov dword [esp + 0x244], 0x40e2fc
call edi
mov ecx, dword [esp + 0x49c]
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
Function at 0x425270
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
xor eax, eax
mov dword [esp + 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
test bl, 1
push esi
mov esi, ecx
mov ecx, 3
cmovne eax, ecx
test bl, 2
mov ecx, 1
cmovne eax, ecx
mov ecx, ebx
and ecx, 4
mov dword [esp + 0x10], ecx
mov ecx, 4
cmovne eax, ecx
test bl, 8
mov ecx, 2
cmovne eax, ecx
mov dword [esp + 0xc], eax
push edi
test bl, 0x10
je 0x4252d0
mov dword [esp + 0x10], 5
jmp 0x4252d8
test eax, eax
je 0x42541c
xor edx, edx
mov edi, 0x40000000
test bl, 0x40
mov eax, 4
cmovne edx, edi
test bl, 0x80
cmovne edx, eax
test bl, 0x20
je 0x4252fb
or edx, 0x80000000
test ebx, 0x4000
je 0x425309
or edx, 0x100
test ebx, 0x40000
je 0x425317
or edx, 0x20000000
mov ecx, ebx
shr ecx, 8
not ecx
and ecx, 1
test ebx, 0x200
jne 0x42532c
or ecx, 2
test ebx, 0x8000
je 0x425336
or ecx, eax
xor eax, eax
test ebx, 0x400
cmovne eax, edi
test ebx, 0x800
je 0x42534e
or eax, 0x100
test ebx, 0x1000
je 0x425359
or eax, 2
test ebx, 0x2000
je 0x425366
or eax, 0x4000000
test ebx, 0x20000
je 0x425373
or eax, 0x2000000
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x42537e
mov edi, dword [edi]
push 0
push eax
push dword [esp + 0x18]
push 0
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov eax, dword [esi]
cmp eax, edi
je 0x4253bd
test eax, eax
je 0x4253b2
cmp eax, 0xffffffff
je 0x4253b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x425425
mov dword [esi], 0
test edi, edi
je 0x4253bd
cmp edi, 0xffffffff
je 0x4253bd
mov dword [esi], edi
mov eax, dword [esi]
test eax, eax
je 0x42540c
cmp eax, 0xffffffff
je 0x42540c
mov eax, ebx
mov dword [esi + 4], 0
shr eax, 0xa
and al, 1
cmp dword [esp + 0x14], 0
mov byte [esi + 9], al
je 0x4253fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne al
mov byte [esi + 8], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test bl, 0xa
je 0x42541c
mov byte [esi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00425480
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00426870
int3
Function at 0x4261c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], 0
mov esi, edx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x426233
cmp dword [0x483890], 0
jne 0x426220
push 0x44
call fcn.0045acd7
add esp, 4
test eax, eax
je 0x4261fd
mov ecx, eax
call fcn.00421940
mov esi, eax
jmp 0x4261ff
xor esi, esi
push 0
push esi
push 0x483890
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x42621d
test esi, esi
je 0x42621d
push ecx
mov ecx, esi
call fcn.00421900
mov esi, dword [ebp - 4]
mov eax, dword [0x483890]
cmp dword [eax], 1
jl 0x426233
mov dword [ebp - 8], 0x10000
jmp 0x426235
xor ebx, ebx
push 8
call fcn.0045acd7
add esp, 4
mov edi, eax
push 0
push dword [ebp - 8]
mov dword [edi], esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
push 0x426100
push ebx
setne cl
push 0
mov byte [edi + 4], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x426278
push edi
call fcn.0045ad4d
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x42628e
mov dword [esi], eax
mov al, 1
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x47ca30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
test cl, cl
je 0x429c32
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0
push 0xffffffffffffffff
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x429bb1
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ed71
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.004140d0
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x240]
call fcn.00417ce0
cmp esi, eax
je 0x429be5
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00414e30
cmp dword [ebp - 0x22c], 8
jb 0x429bfc
push dword [ebp - 0x240]
call fcn.0045ad4d
add esp, 4
xor eax, eax
mov dword [ebp - 0x22c], 7
cmp dword [ebp - 0x214], 8
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
jb 0x429c45
push dword [ebp - 0x228]
call fcn.0045ad4d
add esp, 4
jmp 0x429c45
push esi
push 0x6c
call fcn.00420450
add esp, 8
test al, al
je 0x429ba0
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0x40e14c
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x244], 9
push eax
mov ecx, esi
call fcn.004186e0
cmp esi, eax
je 0x429c7e
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00414e30
cmp dword [ebp - 0x214], 8
jb 0x429c95
push dword [ebp - 0x228]
call fcn.0045ad4d
add esp, 4
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0x40e158
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x244], 0x11
push eax
mov ecx, esi
call fcn.004186e0
cmp esi, eax
je 0x429cce
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00414e30
cmp dword [ebp - 0x214], 8
jb 0x429ce5
push dword [ebp - 0x228]
call fcn.0045ad4d
add esp, 4
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0x40e16c
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x244], 0xc
push eax
mov ecx, esi
call fcn.004186e0
cmp esi, eax
je 0x429d1e
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00414e30
cmp dword [ebp - 0x214], 8
jb 0x429d35
push dword [ebp - 0x228]
call fcn.0045ad4d
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0045ed71
mov esp, ebp
pop ebp
ret

Function at 0x42b030
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov edi, edi
push 0x22c
push 0
push edi
call fcn.00438c15
add esp, 0xc
mov dword [edi], 0x22c
cmp byte [esi + 8], 0
push edi
push dword [esi + 4]
jne 0x42b068
mov byte [esi + 8], 1
call ebx
jmp 0x42b06e
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
setne al
test al, al
je 0x42b08a
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 4]
call edx
test al, al
je 0x42b040
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret