joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4421c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x260
mov eax, dword [0x473388]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x264], eax
mov eax, dword [esi + 0x6c]
xor ebp, ebp
cmp eax, ebp
jne 0x4421f8
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x25c]
call fcn.0044cb9f
add esp, 0x260
ret 4
cmp dword [esi + 0x20], ebp
jne 0x442238
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call sub.MFC71U.DLL_AfxGetStringManager
cmp eax, ebp
je 0x44221f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x442221
xor eax, eax
mov edx, dword [esi]
push ebp
push 0x64
push eax
lea eax, [esp + 0x14]
push eax
push 0x40000000
push ebp
push ebp
mov ecx, esi
call dword [edx + 0x5c]
cmp dword [esi + 0x2ac], ebp
push ebx
push edi
jne 0x44228e
lea ecx, [esi + 0x74]
call fcn.00441380
test al, al
je 0x44235f
mov edi, dword [esi + 0x2ac]
mov edx, dword [esi + 0x54]
mov ebx, dword [edi]
lea ecx, [esi + 0x54]
push 0x6010100
push 0x4621b8
call dword [edx + 4]
push eax
mov ecx, edi
call dword [ebx + 0xc]
test al, al
je 0x44235f
mov ecx, dword [esi + 0x2ac]
mov eax, dword [ecx]
call dword [eax + 0x10]
test al, al
je 0x44235f
mov eax, dword [esi + 0x5c]
cmp eax, ebp
lea ebx, [esi + 0x5c]
je 0x4422db
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4422db
mov eax, dword [esi + 0x70]
cmp eax, ebp
je 0x442375
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x442375
mov ecx, dword [esi + 0x6c]
mov edx, dword [ecx]
push 1
call dword [edx + 0x10]
push 0x65
push 2
mov ecx, esi
call fcn.00441820
jmp 0x442375
mov ecx, dword [esi + 0x2ac]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, eax
call dword [sym.imp.PlatformData.dll_public:_static_class_CParameterGlobal____cdecl_CParameterGlobal::GetInstance_void_]
mov ecx, dword [esp + 0x274]
mov eax, edi
cdq
push edx
push eax
push ecx
push 0x4623c0
lea edx, [esp + 0x74]
push 0x104
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x18
push ebx
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
push ebp
push ebp
push 0x4000000
push ebp
push ebp
push ebp
lea ecx, [esp + 0x84]
push ecx
push ebp
mov dword [esp + 0x48], 0x44
mov word [esp + 0x78], 3
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x442363
xor edx, edx
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
xor al, al
jmp 0x442377
mov eax, dword [esi + 0x20]
push ebp
push 0x4e20
push 0x64
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov al, 1
mov ecx, dword [esp + 0x26c]
pop edi
pop ebx
pop esi
pop ebp
call fcn.0044cb9f
add esp, 0x260
ret 4
Function at 0x442790
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4519fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esi], 0x462450
xor ebx, ebx
mov ecx, 0x11
mov eax, 0xa
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0x462414
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esi + 0x20], 0x462428
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0x46243c
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], 0x462410
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
mov byte [esp + 0x18], 3
je 0x44283e
push eax
call sub.MFC71U.DLL_operator_new_1
add esp, 4
mov dword [esi + 8], ebx
push 0x2c
call sub.MFC71U.DLL_SerializeElements
mov edi, eax
xor eax, eax
mov dword [esi + 8], edi
mov ecx, 0xb
rep stosd dword es:[edi], eax
mov dword [esi + 0xc], 0xb
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, ebx
je 0x442870
push eax
call sub.MFC71U.DLL_operator_new_1
add esp, 4
mov dword [esi + 0x24], ebx
push 0xd4
call sub.MFC71U.DLL_SerializeElements
mov edi, eax
xor eax, eax
mov dword [esi + 0x24], edi
mov ecx, 0x35
rep stosd dword es:[edi], eax
mov dword [esi + 0x28], 0x35
mov eax, dword [esi + 0x40]
add esp, 4
cmp eax, ebx
je 0x4428a5
push eax
call sub.MFC71U.DLL_operator_new_1
add esp, 4
mov dword [esi + 0x40], ebx
push 0xfc4
call sub.MFC71U.DLL_SerializeElements
mov edi, eax
xor eax, eax
mov dword [esi + 0x40], edi
mov ecx, 0x3f1
rep stosd dword es:[edi], eax
mov dword [esi + 0x44], 0x3f1
mov eax, dword [0x47a54c]
add esp, 4
cmp eax, ebx
mov eax, esi
jne 0x4428d8
mov dword [0x47a54c], esi
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4437d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x473388]
mov edx, dword [ebp + 0x14]
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
push edx
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], eax
push 0x40
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x4542ac
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x443893
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.00443740
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [edi], eax
call fcn.00443740
mov dword [edi + 4], eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00443740
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [edi + 8], eax
call fcn.00443740
mov dword [edi + 0xc], eax
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.0044cb9f
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.0044cb9f
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4438b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x473388]
mov edx, dword [ebp + 0x14]
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ecx, edi
mov dword [ecx], eax
push 0x40
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x4542ac
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x44394f
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.00443740
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [edi], eax
call fcn.00443740
mov dword [edi + 4], eax
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.0044cb9f
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.0044cb9f
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x443970
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x473388]
mov edx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push 0x40
lea ecx, [esp + 0x18]
push ecx
push 0x4542ac
push edx
push eax
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x443a25
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
push edx
mov ecx, esi
call fcn.00443740
xor ebx, ebx
mov bh, al
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00443740
mov bl, al
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
shl ebx, 8
call fcn.00443740
movzx edx, al
or ebx, edx
mov dword [edi], ebx
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.0044cb9f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.0044cb9f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44c958
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x463b20
call fcn.0044cf1c
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x44c998
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44c998
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x44c9b0
cmp eax, 0x20b
je 0x44c99d
mov dword [ebp - 0x1c], edi
jmp 0x44c9c4
cmp dword [ecx + 0x84], 0xe
jbe 0x44c998
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x44c9be
cmp dword [ecx + 0x74], 0xe
jbe 0x44c998
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x47a618], 0xffffffff
or dword [0x47a61c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x47a5a0]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x47a59c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x47a614], eax
call fcn.0044cf74
call fcn.0044d014
cmp dword [0x4733b0], edi
jne 0x44ca24
push fcn.0044d014
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0044d002
push 0x4730c4
push 0x4730c0
call sub.MSVCR71.dll__initterm
push 0x44cfb8
call fcn.0044cbe6
mov eax, dword [0x47a598]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x47a594]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x44ca78
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x4730bc
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x44caa2
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x44cb5c
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x44cb11
cmp ax, di
je 0x44cab8
cmp dword [ebp - 0x20], edi
jne 0x44cb11
mov ax, word [esi]
cmp ax, di
je 0x44cacd
cmp ax, 0x20
ja 0x44cacd
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x44cab8
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x44cae9
movzx eax, word [ebp - 0x54]
jmp 0x44caec
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.0044d6c6
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x44cb09
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x44cb56
cmp ax, 0x22
jne 0x44cb22
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x44caa2
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0044cf57
ret
Function at 0x4179e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 1
push edi
mov edi, dword [ebp + 8]
je 0x4179fc
cmp esi, 2
jne 0x417a0a
push dword [ebp + 0x10]
push esi
push edi
call fcn.00434a07
test eax, eax
je 0x417a85
test esi, esi
je 0x417a13
cmp esi, 3
jne 0x417a1d
push dword [ebp + 0x10]
push esi
push edi
call fcn.00434a07
dec esi
jne 0x417a82
push 0x4987c0
mov dword [0x49d5e8], edi
call fcn.00437b56
push 0x49a538
call fcn.004364eb
push 0xa
push 0x12c
push dword [0x49d5e8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x417a82
push esi
push dword [0x49d5e8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x417a82
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [0x49d5e8]
mov dword [0x49d290], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x49d294], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4251c8
Capabilities:
Create pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x485118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x204]
push 0x401cec
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x14
call fcn.0043565b
mov esi, eax
test esi, esi
je 0x425276
push edi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x425224
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x425228
xor eax, eax
jmp 0x425275
lea eax, [ebp - 0x210]
push eax
push 0
mov eax, 0x1000
push eax
push eax
push 0xff
push 0
push 2
lea eax, [ebp - 0x204]
push eax
mov dword [ebp - 0x210], 0xc
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
mov edi, eax
call fcn.0043567b
mov eax, edi
inc eax
neg eax
sbb eax, eax
and eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004347dd
leave
ret 4

Function at 0x42528a
Capabilities:
Create pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x485118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x1fc
lea eax, [ebp - 0x202]
push ebx
push eax
mov word [ebp - 0x204], bx
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x204]
push 0x401cec
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push 0x14
call fcn.0043565b
mov esi, eax
cmp esi, ebx
jne 0x4252e6
xor eax, eax
jmp 0x425357
push edi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x425304
push ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x425308
xor eax, eax
jmp 0x425356
lea eax, [ebp - 0x210]
push eax
push ebx
mov eax, 0x1000
push eax
push eax
push 0xff
push ebx
push 0x80000002
lea eax, [ebp - 0x204]
push eax
mov dword [ebp - 0x210], 0xc
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
mov edi, eax
call fcn.0043567b
mov eax, edi
inc eax
neg eax
sbb eax, eax
and eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004347dd
leave
ret 4

Function at 0x42543f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
je 0x42548a
cmp dword [ebp + 8], 0xffffffff
je 0x42548a
cmp dword [ebp + 0xc], eax
je 0x42548a
mov cl, byte [ebp + 0x10]
push eax
lea eax, [ebp + 0x14]
push eax
push 2
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
mov byte [ebp + 0x10], cl
mov cl, byte [ebp + 0x14]
mov byte [ebp + 0x11], cl
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x425480
cmp dword [ebp + 0x14], 2
je 0x42548a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x42548d
xor eax, eax
inc eax
pop ebp
ret 0x10
Function at 0x42615e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x1a924], 0
je 0x42624a
push 0x250
call fcn.0043565b
mov ecx, dword [esi + 0x1a930]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0x1a92c]
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x1a924]
mov dword [eax], ecx
mov ecx, dword [esi + 0x1a928]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0xc]
lea edx, [eax + 0x14]
sub edx, ecx
movzx esi, word [ecx]
mov word [edx + ecx], si
inc ecx
inc ecx
test si, si
jne 0x4261af
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x220], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [eax + 0x224], ecx
mov ecx, dword [ebp + 0x20]
mov dword [eax + 0x228], ecx
mov ecx, dword [ebp + 0x24]
mov dword [eax + 0x22c], ecx
mov ecx, dword [ebp + 0x28]
mov dword [eax + 0x230], ecx
mov ecx, dword [ebp + 0x2c]
mov dword [eax + 0x234], ecx
mov ecx, dword [ebp + 0x30]
mov dword [eax + 0x238], ecx
mov ecx, dword [ebp + 0x34]
mov dword [eax + 0x23c], ecx
mov ecx, dword [ebp + 0x38]
mov dword [eax + 0x240], ecx
mov ecx, dword [ebp + 0x3c]
mov dword [eax + 0x244], ecx
mov ecx, dword [ebp + 0x40]
mov dword [eax + 0x248], ecx
mov ecx, dword [ebp + 0x44]
mov dword [eax + 0x24c], ecx
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x4254d5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42624d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop esi
pop ebp
ret 0x40

Function at 0x426257
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 4
call fcn.0043565b
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x42536c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42628d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
leave
ret 8

Function at 0x426296
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4262d8
cmp esi, 0xffffffff
je 0x4262d8
push 8
call fcn.0043565b
mov cl, byte [ebp + 0xc]
mov byte [eax + 4], cl
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x425794
push 0
push 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4262db
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop esi
pop ebp
ret 8

Function at 0x4262e5
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 4
call fcn.0043565b
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x425928
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42631b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
leave
ret 4
Function at 0x42f552
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x485118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa28], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp + 0x1c]
xor edi, edi
push 0x3fe
mov dword [ebp - 0xa20], eax
lea eax, [ebp - 0x812]
push edi
push eax
mov word [ebp - 0x814], di
call sub.msvcrt.dll_memset
mov ebx, 0x206
push ebx
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x412]
push edi
push eax
mov word [ebp - 0x414], di
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0xa38]
mov dword [ebp - 0xa24], 1
mov dword [ebp - 0xa30], edi
call fcn.0042ead0
mov ebx, dword [ebp - 0xa2c]
mov word [ebx], di
cmp dword [esi + 0x5ef4], edi
je 0x42f651
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x6708]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esi + 0x6910]
lea edx, [ebp - 0x414]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x42f641
jmp 0x42f6bd
push edi
lea eax, [esi + 0x1a12c]
push eax
push dword [ebp - 0xa34]
lea eax, [ebp - 0xa1c]
push dword [ebp - 0xa28]
push 0x200
push eax
push 0x4018f8
push dword [ebp - 0xa38]
lea eax, [esi + 0x5efa]
push eax
call fcn.0042969f
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esi + 0x6102]
lea ecx, [ebp - 0x414]
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x42f6af
lea eax, [esi + 0x6508]
push eax
lea eax, [esi + 0x630a]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004304f6
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.msvcrt.dll__waccess]
cmp eax, 0xffffffff
pop ecx
pop ecx
jne 0x42f722
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, edi
je 0x42f71a
cmp eax, 0xb7
je 0x42f71a
cmp eax, 0x50
je 0x42f71a
mov ecx, dword [ebp - 0xa20]
mov dword [ecx], eax
mov dword [ebp - 0xa24], edi
jmp 0x42f722
mov eax, dword [ebp - 0xa20]
mov dword [eax], edi
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa28]
push ebx
push esi
call fcn.0042f0f9
cmp dword [ebp - 0xa30], edi
je 0x42f768
mov eax, dword [ebp - 0xa20]
mov dword [eax], pe_nt_image_headers32
mov word [ebx], di
cmp dword [ebp - 0xa24], edi
je 0x42f78a
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x42f775
sub eax, edx
sar eax, 1
je 0x42f78a
xor eax, eax
inc eax
jmp 0x42f78c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004347dd
leave
ret 0x18
Function at 0x42fe7b
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x485118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x214], 0
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x24]
push esi
mov dword [ebp - 0x210], eax
mov eax, ebx
push edi
mov edi, dword [ebp + 0x20]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x42fec9
sub eax, ecx
lea edx, [ebp - 0x20c]
sar eax, 1
mov ecx, ebx
sub edx, ebx
movzx esi, word [ecx]
mov word [edx + ecx], si
inc ecx
inc ecx
test si, si
jne 0x42fee1
test eax, eax
jle 0x42ff03
lea eax, [ebp + eax*2 - 0x20e]
cmp word [eax], 0x5c
jne 0x42ff03
and word [eax], si
and dword [ebp - 0x224], 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], eax
mov esi, 0x4023a0
push dword [ebp + 0x14]
lea eax, [ebp - 0x240]
push dword [ebp - 0x21c]
push dword [ebp - 0x218]
push eax
push dword [ebp - 0x220]
call sub.MPR.dll_WNetAddConnection3W
xor edi, edi
cmp eax, edi
je 0x42ff93
cmp eax, 0x55
je 0x42ff93
cmp eax, 0x4c3
jne 0x42ffa3
cmp dword [ebp + 0x1c], edi
je 0x42ff78
cmp dword [ebp - 0x214], edi
jne 0x42ff78
push dword [ebp - 0x210]
inc edi
push ebx
call fcn.0042fe22
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, esi
movzx eax, word [edx]
inc edx
mov word [ecx], ax
inc edx
inc ecx
inc ecx
test ax, ax
jne 0x42ff82
jmp 0x42ff9d
mov dword [ebp - 0x214], 1
test edi, edi
jne 0x42ff2b
jmp 0x42ffd0
cmp eax, 0x4b8
jne 0x42ffb7
push dword [ebp - 0x210]
call fcn.0042fd2f
jmp 0x42ffd0
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, esi
movzx eax, word [edx]
inc edx
mov word [ecx], ax
inc edx
inc ecx
inc ecx
test ax, ax
jne 0x42ffc1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004347dd
leave
ret 0x20