joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422420
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x110]
mov dword [ebp - 0x128], ecx
push edi
mov esi, edx
mov dword [ebp - 0x110], 0
push eax
lea edx, [ebp - 4]
lea ecx, [ebp - 0x104]
call fcn.00422340
add esp, 4
xor edx, edx
add esi, 2
movzx ecx, byte [esi - 2]
lea esi, [esi + 4]
movzx eax, byte [esi - 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 3]
shl ecx, 8
or ecx, eax
mov dword [ebp + edx*4 - 0x104], ecx
inc edx
cmp edx, 0x10
jb 0x422465
lea eax, [ebp - 0x100]
mov ebx, 0x30
nop
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax + 0x30]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
sub ebx, 1
jne 0x4224a0
mov ebx, dword [ebp - 0x128]
xor edx, edx
mov dword [ebp - 0x110], edx
mov eax, dword [ebx + 4]
mov edi, dword [ebx]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x118], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x114], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x120], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x108], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebx + 0x1c]
mov ebx, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [ebp - 0x10c]
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 0x108]
and eax, ebx
xor ecx, eax
mov eax, edi
add esi, ecx
rol eax, 0xa
add esi, dword [edx + 0x641230]
add esi, dword [ebp + edx - 0x104]
mov edx, edi
add esi, dword [ebp - 0x124]
ror edx, 0xd
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x118]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 0x114]
xor ecx, eax
mov eax, dword [ebp - 0x10c]
add edx, ecx
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x108], ebx
mov ebx, dword [ebp - 0x11c]
mov dword [ebp - 0x11c], eax
add ebx, esi
mov eax, edi
mov dword [ebp - 0x114], ecx
lea edi, [edx + esi]
mov dword [ebp - 0x118], eax
mov edx, dword [ebp - 0x110]
add edx, 4
mov dword [ebp - 0x110], edx
cmp edx, 0x100
jb 0x422535
add eax, dword [ebp - 0x12c]
mov dword [ebp - 0x120], ebx
mov ebx, dword [ebp - 0x128]
add dword [ebx + 8], ecx
mov ecx, dword [ebp - 4]
mov dword [ebx + 4], eax
xor ecx, ebp
mov eax, dword [ebp - 0x11c]
add dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x120]
add dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x108]
add dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x10c]
add dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x124]
add dword [ebx + 0x1c], eax
add dword [ebx], edi
pop edi
pop esi
pop ebx
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
Function at 0x424370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed860
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x673f64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00454d05
mov esi, eax
add esp, 4
test esi, esi
je 0x4243d0
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0059d701
add esp, 4
mov dword [esi + 4], eax
jmp 0x4243d2
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429f00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef99c
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
mov eax, dword [0x673f64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
xor eax, eax
mov dword [ebp - 0x28], 0
push 0x640d90
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004059d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 4
xor eax, eax
mov dword [ebp - 0x40], 0
push str.WNZP
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.004059d0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.004350c0
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00433680
test al, al
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x48]
sete byte [ebp - 0xd]
cmp edx, 8
jb 0x429fe2
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429fd8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a127
push edx
push ecx
call fcn.0058a7f7
add esp, 8
xor eax, eax
mov dword [ebp - 0x4c], 0
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
cmp edx, 8
jb 0x42a033
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a029
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a127
push edx
push ecx
call fcn.0058a7f7
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x42a074
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a06a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a127
push edx
push ecx
call fcn.0058a7f7
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp byte [ebp - 0xd], al
jne 0x42a0d7
push str.CorelStubFramework
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42a0e9
push 0
push str.HTMLUI
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x42a0d7
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42a0d7
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.00454d05
add esp, 4
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x42a0d7
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov ecx, eax
movq qword [eax + 0x10], xmm0
push esi
call fcn.00428140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.005b1b1f
int3
Function at 0x42a390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5edb96
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
test edi, edi
je 0x42a3cb
mov esi, dword [edi + 4]
jmp 0x42a3cd
xor esi, esi
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xe8]
cmp eax, dword [esi + 0x18]
jne 0x42a43c
push 0xf
xor eax, eax
mov dword [ebp - 0x48], 0
push str.selfupdate_code
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
call fcn.004059d0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ebx, 1
lea edx, [ebp - 0x48]
push eax
mov ecx, esi
mov dword [ebp - 0x30], ebx
call fcn.00434a20
add esp, 4
mov byte [ebp - 0x29], bl
test al, al
jne 0x42a440
mov byte [ebp - 0x29], 0
test bl, 1
je 0x42a47f
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x42a47f
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a475
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a51c
push edx
push ecx
call fcn.0058a7f7
add esp, 8
cmp byte [ebp - 0x29], 0
je 0x42a49f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005c1ddf
add esp, 4
mov dword [esi + 0xe8], eax
mov edx, dword [ebp - 0x14]
mov esi, dword [esi + 0xe8]
cmp edx, 8
jb 0x42a4db
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a4d1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a521
push edx
push ecx
call fcn.0058a7f7
add esp, 8
test edi, edi
je 0x42a4f1
mov ecx, edi
call fcn.00428370
push 0x18
push edi
call fcn.0058a7f7
add esp, 8
cmp esi, 0x304a8
jne 0x42a500
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
call fcn.005b1b1f
call fcn.005b1b1f
int3
Function at 0x42a530
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5edd4d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x673f64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
test esi, esi
jne 0x42a575
mov eax, 0xc9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42a654
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42a63e
mov ecx, esi
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a5b0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.004059d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov esi, dword [edi + 0xc]
push ecx
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x42a5ec
mov ecx, eax
call fcn.0040bd00
add dword [esi + 0xc], 0x18
jmp 0x42a5f5
push eax
lea ecx, [esi + 8]
call fcn.0043c4e0
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x42a62b
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42a621
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a66a
push edx
push ecx
call fcn.0058a7f7
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xca
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xc8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.005b1b1f
int3
Function at 0x430590
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push ecx
push eax
lea eax, [ebp - 0x14]
mov edi, edx
push eax
lea edx, [ebp - 0x18]
call fcn.004301c0
add esp, 0xc
test al, al
jne 0x4305cf
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
mov eax, dword [edi + 4]
push ebx
mov ebx, dword [ebp - 0xc]
sub eax, ecx
push eax
push ecx
xor ecx, ecx
mov eax, str.Content_type:_application_x_www_form_urlencoded
cmp byte [ebp + 0x10], cl
push 0
cmove eax, ecx
push eax
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x43061d
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call esi
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
call esi
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
xor ebx, ebx
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
lea edi, [ebx + 0x10000]
mov edx, dword [esi]
mov ecx, eax
sub ecx, edx
mov dword [ebp - 0x10], eax
cmp edi, ecx
jae 0x43063f
lea eax, [edx + edi]
jmp 0x43066a
jbe 0x43066d
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x430655
push ecx
push edi
mov ecx, esi
call fcn.00430740
jmp 0x43066d
sub edi, ecx
push edi
push 0
push dword [ebp - 0x10]
call fcn.005ae810
mov eax, dword [ebp - 0x10]
add esp, 0xc
add eax, edi
mov dword [esi + 4], eax
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push 0x10000
add eax, ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4306da
mov eax, dword [ebp - 8]
test eax, eax
je 0x430693
add ebx, eax
jmp 0x430624
mov edi, dword [esi + 4]
mov ecx, edi
mov edx, dword [esi]
sub ecx, edx
cmp ebx, ecx
jae 0x4306aa
lea eax, [edx + ebx]
mov bl, 1
mov dword [esi + 4], eax
jmp 0x4306e1
jbe 0x4306d6
mov eax, dword [esi + 8]
sub eax, edx
cmp ebx, eax
jbe 0x4306c2
push ecx
push ebx
mov ecx, esi
call fcn.00430740
mov bl, 1
jmp 0x4306e1
sub ebx, ecx
push ebx
push 0
push edi
call fcn.005ae810
lea eax, [ebx + edi]
add esp, 0xc
mov dword [esi + 4], eax
mov bl, 1
jmp 0x4306e1
mov eax, dword [esi]
xor bl, bl
mov dword [esi + 4], eax
push dword [ebp - 0xc]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
Function at 0x431eb0
Capabilities:
Check if file exists
Copy file
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f0176
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov ecx, esp
push 0x12
push 0x646ac4
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.004059d0
lea ecx, [ebp - 0x260]
call fcn.00431b90
mov ecx, esp
mov dword [ebp - 4], 0
push 0xf
push str.parentProcessID
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.004059d0
lea ecx, [ebp - 0x230]
call fcn.00431b90
add esp, 0x18
mov byte [ebp - 4], 1
cmp dword [ebp - 0x250], 0
je 0x43202f
cmp dword [ebp - 0x220], 0
je 0x43202f
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x640d7c
lea ecx, [ebp - 0x248]
call fcn.00405980
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.004345f0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43200b
lea ecx, [ebp - 0x248]
call fcn.00405880
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43200b
lea ecx, [ebp - 0x248]
call fcn.00405880
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xa
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x230]
call fcn.00405880
push eax
call fcn.005c30c2
add esp, 0xc
mov ecx, eax
call fcn.00431e80
push 0
lea ecx, [ebp - 0x248]
call fcn.00405880
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0xa
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x260]
call fcn.00405880
push eax
call fcn.005c30c2
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x43206b
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432061
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4320df
push edx
push ecx
call fcn.0058a7f7
add esp, 8
mov edx, dword [ebp - 0x24c]
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp edx, 8
jb 0x4320c4
mov ecx, dword [ebp - 0x260]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4320ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4320df
push edx
push ecx
call fcn.0058a7f7
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
call fcn.005b1b1f
int3
Function at 0x432d50
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x24c]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x103
jb 0x432d90
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x208
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x432dd6
lea ecx, [ebp - 0x65c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432dc3
lea eax, [ebp - 0x65c]
jmp 0x432df1
lea ecx, [ebp - 0x24c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432de0
lea eax, [ebp - 0x24c]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004059d0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x432e08
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x432e28
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
push edi
lea eax, [ebp - 0x44]
push 0x646c38
push eax
call fcn.00422950
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x432e4d
mov eax, dword [esi]
lea ecx, [ebp - 0x44]
push ecx
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x24c]
push eax
call ebx
test eax, eax
je 0x432e7c
inc edi
jmp 0x432e31
push 0
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0x24c]
lea ecx, [edx + 2]
pop edi
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x432e95
sub edx, ecx
lea eax, [ebp - 0x24c]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.004059d0
mov ecx, dword [ebp - 4]
mov al, 1
pop ebx
xor ecx, ebp
pop esi
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
Function at 0x433540
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f03fd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], esi
jle 0x433657
nop dword [eax + eax]
mov edx, dword [eax + esi*4]
xor eax, eax
mov dword [ebp - 0x34], 0
mov word [ebp - 0x34], ax
mov eax, edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x1c], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4335b6
sub eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
sar eax, 1
push eax
push edx
call fcn.004059d0
mov dword [ebp - 4], 0
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x433601
movups xmm0, xmmword [ebp - 0x34]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov word [ebp - 0x34], ax
jmp 0x433610
lea ecx, [ebp - 0x34]
push ecx
push eax
mov ecx, edi
call fcn.00438fb0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x43364a
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x433640
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433679
push edx
push ecx
call fcn.0058a7f7
add esp, 8
mov eax, dword [ebp - 0x18]
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x433590
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
call fcn.005b1b1f
int3
Function at 0x434a20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f063d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], 0x208
mov dword [ebp - 0x4c], 0x101
mov dword [ebp - 0x48], 0x201
call fcn.0040bd00
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.00432950
mov ecx, eax
mov byte [ebp - 0x39], 0
mov dword [ebp - 0x44], ecx
xor edi, edi
nop dword [eax + eax]
cmp dword [ebp - 0x20], 8
lea edx, [ebp - 0x38]
push edx
push dword [ebp + edi*4 - 0x4c]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434b3f
push 0x200
call fcn.00454d42
add esp, 4
mov esi, eax
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x434ace
mov eax, dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push esi
lea ecx, [ebp - 0x1c]
push ecx
push 0
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434b20
cmp dword [ebp - 0x1c], 4
mov byte [ebp - 0x39], 1
jne 0x434b02
push dword [esi]
push 0x6433a8
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434b07
mov ecx, dword [ebp - 0x40]
sub eax, edx
sar eax, 1
push eax
push esi
call fcn.004059d0
push 2
push esi
call fcn.0058a7f7
mov eax, dword [ebp - 0x38]
add esp, 8
test eax, eax
je 0x434b39
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x39], 0
jne 0x434b4c
mov ecx, dword [ebp - 0x44]
inc edi
cmp edi, 2
jb 0x434a90
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x434b82
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x434b78
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x434ba1
push edx
push ecx
call fcn.0058a7f7
add esp, 8
mov al, byte [ebp - 0x39]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
call fcn.005b1b1f
int3