joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4274e0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x427508
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x42766e
mov esi, esi
xor eax, eax
push 0x42764f
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 1
mov eax, dword [ebp - 0xc]
mov byte [eax + 5], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 8], 1
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov dword [ebp - 0x14], 0x11
lea eax, [ebp - 0x14]
push eax
mov edx, 0x620938
mov eax, dword [ebp - 0xc]
add eax, 0x2c
mov ecx, 1
call fcn.0040d060
mov eax, dword [ebp - 0xc]
add eax, 0xc
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xc]
add eax, 0x10
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xc]
add eax, 0x14
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xc]
add eax, 0x18
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xc]
add eax, 0x1c
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xc]
add eax, 0x20
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xc]
add eax, 0x24
xor edx, edx
call fcn.0040a690
mov eax, dword [ebp - 0xc]
add eax, 0x28
xor edx, edx
call fcn.0040a690
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword [edx + 0x40], eax
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
mov edx, 0x620960
mov eax, dword [ebp - 0xc]
add eax, 0x3c
mov ecx, 1
call fcn.0040d060
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x427644
cmp dword [ebp - 8], 0
je 0x427644
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x42766e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4280b0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
xor cl, cl
mov edx, 0x58
call fcn.004037f0
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x429ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040cff0
mov eax, dword [ebp - 8]
call fcn.0040cff0
xor eax, eax
push fcn.00429a90
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [esi - 1]
mov esi, 0xffffffff
add esi, 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov al, byte [eax + esi]
mov dl, byte [edx + esi]
xor dl, al
mov eax, dword [ebx]
mov byte [eax + esi], dl
cmp ecx, esi
ja 0x429af0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00429a90
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x429e30
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, edx
call fcn.00408b90
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x254], 0
xor eax, eax
push fcn.00429de0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x26c], 0
push 0
push 2
call fcn.00554180
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x429eb0
mov byte [ebp - 0x268], 0
jmp 0x429fdf
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push ebx
call fcn.00554190
test eax, eax
jne 0x429ee0
push ebx
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 0x268], 0
jmp 0x429fdf
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x254]
call fcn.004598a0
mov edx, dword [ebp - 0x254]
lea ecx, [ebp - 0x240]
mov eax, 0x620a30
call fcn.004282c0
lea ecx, [ebp - 0x244]
lea edx, [ebp - 0x240]
mov eax, 0x620a30
call fcn.00428240
lea esi, [esi]
push 1
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x20c]
xor cx, cx
mov edx, 0x103
call fcn.0040b980
lea ecx, [ebp - 0x24c]
mov eax, dword [ebp - 0x250]
xor edx, edx
call fcn.0043de30
mov edx, dword [ebp - 0x24c]
lea ecx, [ebp - 0x264]
mov eax, 0x620a30
call fcn.004282c0
lea edi, [ebp - 0x240]
lea esi, [ebp - 0x264]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x248]
lea edx, [ebp - 0x240]
mov eax, 0x620a30
call fcn.00428240
mov edx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x244]
call fcn.00409780
test eax, eax
jne 0x429fb8
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x228]
je 0x429fb8
mov byte [ebp - 0x26c], 1
nop
lea eax, [ebp - 0x230]
push eax
push ebx
call fcn.005541a0
test eax, eax
jne 0x429f20
push ebx
call sub.kernel32.dll_CloseHandle
mov al, byte [ebp - 0x26c]
mov byte [ebp - 0x268], al
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00429de0
mov al, byte [ebp - 0x268]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42acf0
Capabilities:
Parse pe header

Disassembly:
cmp word [edx], 0x5a4d
je 0x42acfc
xor eax, eax
ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x42ad0c
mov eax, dword [edx + 0x28]
ret
xor eax, eax
ret
Function at 0x42b0b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], edx
mov ebx, ecx
mov al, byte [ebp + 8]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 4]
call fcn.00408b90
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0042b080
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x18]
call fcn.00403d00
push 0
mov eax, dword [ebx]
mov ecx, dword [eax + 0x18]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x18]
call fcn.00408cc0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x42b129
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x42b135
mov eax, 0x6722f0
call fcn.00441760
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.0040b370
mov esi, 0xffffffff
lea esi, [esi]
add esi, 1
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0xa0000000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x42b171
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42b274
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0xc], eax
mov eax, ebx
xor ecx, ecx
xor edx, edx
call fcn.004630c0
mov eax, dword [ebp - 0xc]
add eax, 1
call fcn.004101e0
mov edi, eax
mov edx, edi
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00463060
mov dword [ebp - 0x38], eax
cmp eax, dword [ebp - 0xc]
jne 0x42b264
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x38], 0x100
jbe 0x42b240
mov eax, edi
cmp byte [eax], 0x4d
jne 0x42b1f4
cmp byte [eax + 1], 0x5a
jne 0x42b1f4
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x34], 0
nop
mov eax, edi
cmp byte [eax], 0xd0
jne 0x42b218
cmp byte [eax + 1], 0xcf
jne 0x42b218
cmp byte [eax + 2], 0x11
jne 0x42b218
cmp byte [eax + 3], 0xe0
jne 0x42b218
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], 0
test dword [ebp - 0x34], 0xffffffff
jne 0x42b240
mov edx, edi
mov eax, dword [ebp - 0x24]
call fcn.0042acf0
mov dword [ebp - 0x30], eax
cmp eax, 0x1000
sete byte [ebp - 0x28]
mov esi, esi
mov al, byte [ebp - 0x2c]
test al, al
je 0x42b264
mov al, byte [ebp - 0x28]
test al, al
je 0x42b264
cmp dword [ebp - 0x38], 0x989680
jbe 0x42b264
test dword [ebp - 0x34], 0xffffffff
jne 0x42b264
mov byte [ebp - 0x20], 1
mov eax, edi
call fcn.004101a0
mov eax, ebx
call fcn.00463130
jmp 0x42b287
push 0xbb8
call sub.kernel32.dll_Sleep
cmp esi, 0x3b
jb 0x42b150
mov al, byte [ebp - 0x20]
test al, al
je 0x42b294
mov al, byte [ebp - 0x1c]
test al, al
nop
mov bl, byte [ebp - 0x20]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042b080
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42c550
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x25c]
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x25c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.0042c520
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0x25c]
mov dword [eax], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov edi, eax
mov esi, edx
lea ebx, [ebp - 8]
mov eax, ebx
call fcn.00403d00
push esi
push edi
mov edx, ebx
xor cx, cx
mov eax, 0xffffffff
call fcn.00409e00
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x5f4ca0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f4ca0]
mov eax, 0x617d90
call fcn.00423b60
push 0
mov eax, 0x6212a8
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24c], eax
lea edx, [ebp - 0x254]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.00408f50
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42c642
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42c670
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 0x25c]
mov dword [edx], eax
mov eax, dword [ebp - 0x258]
xor edx, edx
call fcn.00408bc0
jmp 0x42c72a
push 0xc
lea eax, [ebp - 0x24]
push eax
call fcn.00446a00
push 0x224
lea eax, [ebp - 0x248]
push eax
call fcn.00446a00
mov dword [ebp - 0x244], 0x224
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x244]
lea eax, [ebp - 0x248]
push eax
push 0xc
lea eax, [ebp - 0x24]
push eax
push 0x2d1400
push ebx
call sub.kernel32.dll_DeviceIoControl
or eax, eax
jne 0x42c6e0
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 0x25c]
mov dword [edx], eax
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x258]
xor edx, edx
call fcn.00408bc0
jmp 0x42c72a
cmp dword [ebp - 0x230], 0
je 0x42c702
lea eax, [ebp - 0x248]
add eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.00409510
jmp 0x42c70e
mov eax, dword [ebp - 0x25c]
mov dword [eax], 0xffffffff
cmp ebx, 0xffffffff
je 0x42c71c
push ebx
call sub.kernel32.dll_CloseHandle
lea esi, [esi]
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0x14]
call fcn.00408bc0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042c520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42c8f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x28]
push ebx
push esi
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0042c8c0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x28], 0x40
lea esi, [esi]
add byte [ebp - 0x28], 1
lea eax, [ebp - 0x10]
call fcn.00403d00
push 0
mov al, byte [ebp - 0x28]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.004094b0
mov edx, dword [ebp - 0x14]
mov ecx, 0x6212b8
lea eax, [ebp - 0x10]
call fcn.00408cc0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42c970
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x42c9f0
push 0
mov eax, str.._
mov dword [ebp - 0x20], eax
mov al, byte [ebp - 0x28]
lea ecx, [ebp - 0x24]
xor dx, dx
call fcn.004094b0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, 0x6212dc
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 2
call fcn.00408f50
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0042c430
mov ebx, eax
mov dword [ebp - 0xc], 0
cmp ebx, 0xffffffff
je 0x42c9f0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, esi
call fcn.0042c550
cmp dword [ebp - 0xc], 0
jne 0x42c9f0
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0042c770
lea esi, [esi]
cmp byte [ebp - 0x28], 0x5a
jb 0x42c938
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042c8c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42cd40
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.0042cd20
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 8]
call fcn.0045fbc0
mov dword [ebp - 0xc], eax
xor eax, eax
push fcn.0042cd10
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x14]
call fcn.0045fbb0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00408bc0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0042cd10
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x5f4fb0
call sub.shell32.dll_SHGetKnownFolderPath
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.0040b430
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x14
call fcn.00408bc0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x14]
call fcn.0042cb50
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.00408bc0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 2
call fcn.00408f50
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x5f4ce0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f4ce0]
mov eax, 0x617d90
call fcn.00423b60
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
call fcn.0042c360
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00408bc0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042cd20
mov esp, ebp
pop ebp
ret
Function at 0x433620
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x224]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x218], 0
xor eax, eax
push fcn.00433600
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408bc0
mov eax, dword [edi]
cmp byte [eax + 5], 0
je 0x433686
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x2a
push 0
call sub.shell32.dll_SHGetFolderPathW
mov ebx, eax
jmp 0x43369c
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x1c
push 0
call sub.shell32.dll_SHGetFolderPathW
mov ebx, eax
test ebx, ebx
jne 0x4336bc
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
xor cx, cx
mov edx, 0x104
call fcn.0040b980
lea esi, [esi]
mov eax, dword [edi]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0xb], 0
je 0x4336e8
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00433a60
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 4]
call fcn.00408bc0
cmp dword [ebp - 4], 0
jne 0x4336f8
xor bl, bl
jmp 0x4337b2
lea edx, [ebp - 8]
mov eax, esi
call fcn.00433800
mov eax, esi
lea edx, [ebp - 0x218]
call fcn.00433930
mov edx, dword [ebp - 0x218]
mov eax, dword [edi]
add eax, 0x10
call fcn.00408bc0
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x224], eax
mov eax, 0x622100
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x21c], eax
lea edx, [ebp - 0x224]
mov eax, dword [edi]
add eax, 0x20
mov ecx, 2
call fcn.00408f50
push 0
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x224], eax
mov eax, 0x622100
mov dword [ebp - 0x220], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x21c], eax
lea edx, [ebp - 0x224]
mov eax, dword [edi]
add eax, 0x1c
mov ecx, 2
call fcn.00408f50
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
mov dl, 1
call fcn.004595c0
test al, al
jne 0x4337b0
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
call fcn.00459420
test al, al
jne 0x4337b0
xor bl, bl
jmp 0x4337b2
mov bl, 1
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00433600
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433a60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x228]
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408b90
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00433a30
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, 0x6211ec
call fcn.0042c0a0
mov edi, eax
call fcn.0042cf50
mov ecx, dword [edi + 8]
mov edx, 1
mov eax, 0x621b68
call fcn.00432400
mov edi, eax
mov eax, dword [esi]
cmp byte [eax + 5], 0
je 0x433b25
mov eax, edi
mov edx, 1
call fcn.0042cfb0
mov esi, eax
lea ecx, [ebp - 8]
xor edx, edx
mov eax, esi
mov esi, dword [esi]
call dword [esi + 0x7c]
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x228], eax
mov eax, 0x622100
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x220], eax
lea edx, [ebp - 0x228]
lea eax, [ebp - 0xc]
mov ecx, 2
call fcn.00408f50
jmp 0x433ba1
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x23
push 0
call sub.shell32.dll_SHGetFolderPathW
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
xor cx, cx
mov edx, 0x104
call fcn.0040b980
mov eax, edi
mov edx, 2
call fcn.0042cfb0
mov esi, eax
lea ecx, [ebp - 8]
mov edx, 1
mov eax, esi
mov esi, dword [esi]
call dword [esi + 0x7c]
push 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x228], eax
mov eax, 0x622100
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x220], eax
lea edx, [ebp - 0x228]
lea eax, [ebp - 0xc]
mov ecx, 2
call fcn.00408f50
mov eax, dword [ebp - 0xc]
mov dl, 1
call fcn.004595c0
test al, al
jne 0x433bc8
mov eax, dword [ebp - 0xc]
call fcn.00459420
test al, al
jne 0x433bc8
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00408bc0
lea esi, [esi]
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00408bc0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00433a30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x439430
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
mov ebx, eax
mov esi, edx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00439420
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xc], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x43946a
mov eax, dword [eax - 4]
add eax, 1
test eax, eax
je 0x439478
mov byte [ebp - 8], 0
jmp 0x4394ee
mov byte [ebx + 4], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5f18f0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f18f0]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4394a8
mov eax, 0x6722f0
push eax
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateMutexA
test eax, eax
jbe 0x4394e8
mov byte [ebp - 0xc], 1
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x4394cc
mov byte [ebx + 4], 1
mov esi, esi
push dword [0x5f1b20]
mov edx, 0x620960
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
mov eax, dword [esi]
add eax, 0x3c
call fcn.0040d500
mov esi, esi
mov al, byte [ebp - 0xc]
mov byte [ebp - 8], al
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00439420
mov al, byte [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439960
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
xor eax, eax
push fcn.00439930
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov edx, dword [eax + 0x3c]
mov ecx, dword [0x5f1c00]
mov eax, dword [ebp - 0x3c]
call fcn.00438790
test al, al
jne 0x4399c4
mov byte [ebp - 0x34], 0
jmp 0x439b5a
mov byte [ebp - 0x40], 1
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x28]
push eax
mov edx, 0x6222a8
lea eax, [ebp - 0x24]
mov ecx, 1
call fcn.0040d060
mov ecx, 0x622270
mov edx, dword [0x5f1bc0]
mov eax, dword [ebp - 0x24]
call fcn.0040d040
mov ecx, 0x622270
mov edx, dword [0x5f1bd0]
mov eax, dword [ebp - 0x24]
add eax, 4
call fcn.0040d040
mov ecx, 0x622270
mov edx, dword [0x5f1be0]
mov eax, dword [ebp - 0x24]
add eax, 8
call fcn.0040d040
mov ecx, 0x622270
mov edx, dword [0x5f1bf0]
mov eax, dword [ebp - 0x24]
add eax, 0xc
call fcn.0040d040
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 0x2c]
cmp byte [eax + 0x10], 0
jne 0x439b1c
mov dword [ebp - 0x44], 0
push 0x80000000
push 0
push 0
call fcn.00554b30
mov edi, eax
test edi, edi
je 0x439b1c
mov eax, dword [ebp - 0x24]
call fcn.0040cf30
mov esi, eax
mov dword [ebp - 0x44], 0xffffffff
lea esi, [esi]
add dword [ebp - 0x44], 1
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov eax, dword [eax + edx*4]
call fcn.0040cf30
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov edx, dword [eax + edx*4]
mov eax, 0x617d90
call fcn.00423b60
push 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x439aba
mov eax, dword [eax - 4]
mov edx, eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x439ac8
mov eax, 0x6722f0
lea ecx, [ebp - 0x2c]
call fcn.00441760
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x439adc
mov eax, 0x6722f0
push eax
push edi
call fcn.00554b40
mov ebx, eax
test ebx, ebx
setne al
and eax, 0xff
neg eax
je 0x439b10
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.00554b50
test eax, eax
je 0x439b10
cmp dword [ebp - 0x18], 4
jne 0x439b19
mov byte [ebp - 0x40], 0
nop
jmp 0x439b19
cmp esi, dword [ebp - 0x44]
ja 0x439a80
lea esi, [esi]
mov al, byte [ebp - 0x40]
test al, al
je 0x439b54
mov ebx, 0x620960
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [0x5f1c10]
mov edx, dword [0x5f1c00]
mov eax, dword [ebp - 0x3c]
call fcn.004388c0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea eax, [ecx + 0x3c]
mov ecx, ebx
call fcn.0040d040
mov esi, esi
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x34], al
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00439930
mov al, byte [ebp - 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret