joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431b16
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x431b3d
push 0x4740
push 1
push 0x6968
call fcn.00431bff
add esp, 0xc
jmp 0x431bfb
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x431ba5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x431b8e
push 0x1b9f
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x431ba3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 3
jmp 0x431bfb
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x431bdf
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x431bdd
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x431bfb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x431bfb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esp, ebp
pop ebp
ret
Function at 0x432505
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x43263f
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4325ac
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x432589
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x432587
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x4325a7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4325a7
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
jmp 0x43263d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
push 0x3ae8
push 0xa5c
push 0x460
push 0x4a36
push 0x492c
push 0x7563
push 0x2de7
push 1
push 0x1e73
push 0x6200
push dword [ebp - 0x3c]
push 0
push dword [ebp - 0x40]
push 0x7d00
push 1
push 0x1a85
push 1
push 0x331b
push dword [ebp - 0x44]
push 0x32f1
push 0x1f92
push 0x4455
push 0xb72
push 0x5910
push 0x7f5
push 1
push 0x333b
push 0x7c2a
call fcn.004386ef
add esp, 0x70
jmp 0x432672
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
push eax
push 0xea2
push 0
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0xb6d
call fcn.0042f2bd
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x432e08
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x432ee6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x432e63
push 0x6a5a
push 0x7a63
push 0x39c1
push 0x5edf
push 0x4122
push 0x2c12
push 1
call fcn.00432f18
add esp, 0x1c
jmp 0x432ee4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x432eb3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x432eb1
push 0x29b1
push 0x794
push 1
push 0x1a3f
push 0xa36
push 0
push 0
call fcn.004486b9
add esp, 0x1c
jmp 0x432ee4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x432ee4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1347
push 0xc3d
push 0x992
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x432f14
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x432f0c
push 0x1933
push 1
push 0x7c52
call fcn.0043007f
add esp, 0xc
jmp 0x432f14
push 0
call fcn.00434b36
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4345ef
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push esi
movzx eax, byte [ebp + 0x34]
test eax, eax
je 0x434622
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x68], eax
push 1
push dword [ebp - 0x48]
push dword [ebp - 0x68]
call fcn.00434771
add esp, 0xc
jmp 0x43476c
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4346db
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x60]
push 0x3a50
push dword [ebp - 0x40]
push 1
push dword [ebp - 0x80]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x27ec
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call fcn.0042ece9
add esp, 0x2c
jmp 0x43476c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x43472e
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x43472c
push 0x727
push 0xd0d
push 0
push 0xd3b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x43476c
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.0042aeee
mov esi, eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.0042aeee
mov ecx, dword [esi]
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4347f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4348a3
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x434882
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43486f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43486d
push 1
push 1
push 1
push 1
push 0x4cb3
call fcn.0042e7c4
add esp, 0x14
jmp 0x434880
push 0
push 0x98d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x4348a1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0x5acc
push 0x2af7
push dword [ebp - 0x24]
push 1
push 0
call fcn.004405ae
add esp, 0x14
jmp 0x4348c6
push 0x6d7a
push 0x7b66
push 0x408e
push 0x36a4
push 0
push 0x51c0
call fcn.0042f797
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x435ed2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x435f5b
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x435f33
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x435f16
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x435f31
push 0
push 0x171
push 0x21ea
push 0x1b4f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x435f59
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0x2ef8
push 1
push 1
push 0x59d7
push 0x78dd
push 0
push dword [ebp - 0x14]
call fcn.0043a384
add esp, 0x1c
jmp 0x435f69
push 0x7d8c
push 0
call fcn.0043c686
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4361a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4362dd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43629f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x436256
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x436237
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x436254
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0042aeee
mov dword [eax], 0xadd3
jmp 0x43622c
jmp 0x43629d
mov dword [ebp - 0x44], 0x91a049fe
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43627b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43629d
push 0x2211
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4362db
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0x4350
push 0x7429
push 0x559a
push 0x3d6b
push 1
push 0x4fbd
push 1
push 0xcf
call fcn.0043011c
add esp, 0x28
jmp 0x4362eb
push 0x7070
push 0
call fcn.00434373
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x437ffc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4380d5
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x438069
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x4d82
push 0xeb4
push 0x1286
push 0x487d
push dword [ebp - 0x10]
push 0x622d
push 0x1c5b
push 0
call fcn.00438f84
add esp, 0x20
jmp 0x4380d3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4380c8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [eax], 3
jmp 0x4380b3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x4380c6
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x5653d423
jmp 0x4380a8
jmp 0x4380d3
push 0x1ed3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4380dd
push 1
call fcn.0042e886
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43a929
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43a9ec
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43a9be
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43a9aa
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43a9a8
push 1
push 0x65d6
push 1
push 1
push 0x7d79
push 0x2dfd
push 1
call fcn.00430891
add esp, 0x1c
jmp 0x43a9bc
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43a9bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43a9ea
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43a9e0
push 0x24c0
push 0x122d
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x43a9ea
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x43aa04
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0x7a8d
push 0
call fcn.00431f45
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x43e0ff
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x43e140
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 0x4eaf
push 1
push dword [ebp - 0xc]
call fcn.0043e1e6
add esp, 0x14
jmp 0x43e1e2
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43e1aa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43e186
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x43e1a8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x43e1e2
push 0x37d1
push 0xaff
push 0x3cfc
push 0x10df
push 1
push 0x5cbd
push 0x7b8
push 0
push 1
push 0
push 0x6700
push 0x2327
call fcn.0042ea92
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x43e20e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43e2da
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43e2bb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43e2b1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43e292
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x43e2af
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0042aeee
mov dword [eax], 0xfffffffa
jmp 0x43e287
jmp 0x43e2b9
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x43e2d8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x34]
push 0x24d8
push 0x5c00
call fcn.00441330
add esp, 0x10
jmp 0x43e31b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
push 0x4f4f
push 0x2e19
push 0x1f10
push 0
push 1
push dword [ebp - 0x38]
push 0x2ebd
push 0x794c
push 0x665f
push dword [ebp - 0x3c]
push 0x6703
call fcn.0043b5f7
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x43f1ae
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43f1ef
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x10], eax
push 0x3bdc
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
call fcn.00452099
add esp, 0x14
jmp 0x43f2bf
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43f24b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push 0x6901
push dword [ebp - 0x20]
push 0x6891
push 1
push dword [ebp - 0x24]
call fcn.00431914
add esp, 0x14
jmp 0x43f2bf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43f292
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x43f290
push 0x11c4
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x43f2bf
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [eax + 0x18]
sub eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0x18], eax
mov esp, ebp
pop ebp
ret
Function at 0x44712b
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x447175
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x7e83
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0044725b
add esp, 0x18
jmp 0x447257
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4471da
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x4cb5
push 0x426a
push dword [ebp - 0x34]
call fcn.00431242
add esp, 0x18
jmp 0x447257
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x447243
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x447224
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x447241
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.0042aeee
mov dword [eax], 0xfffffff6
jmp 0x447219
jmp 0x447257
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x447257
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret