joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x452bc0
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xc50d80]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x452bfb
je 0x452c4a
cmp ebx, 0x20
jbe 0x452c50
cmp ebx, 0x40
jbe 0x452c8e
jmp 0x452d1f
test ebx, ebx
je 0x452c40
add eax, 0x10
test ax, 0xff0
je 0x452c2c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x940540]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x940640]
jmp 0x452c18
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x452c18
pxor xmm1, xmmword [0xc50d90]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xc50d90]
pxor xmm2, xmmword [0xc50da0]
pxor xmm3, xmmword [0xc50db0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xc50d90]
pxor xmm2, xmmword [0xc50da0]
pxor xmm3, xmmword [0xc50db0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x452d7e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x453a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x1b8
mov dword [esp], esp
mov dword [esp + 4], 0x1b8
call fcn.00453550
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.00453550
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x453b90
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00452ad0
call fcn.0042dcc0
ret
Function at 0x4016a0
Capabilities:
Get geographical location

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44dd58
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x40180b
push ebp
push edi
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_5
mov eax, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x146
push eax
mov dword [esp + 0x48], 0
call ebp
xor ecx, ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x1e], ecx
push 0x14
mov dword [esp + 0x26], ecx
push edx
mov dword [esp + 0x2e], ecx
push 0xc
mov dword [esp + 0x36], ecx
push 0x400
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], 0
mov word [esp + 0x3e], cx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42u.DLL_CString::CString_4
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x38], 1
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40174d
push 0x3b
lea ecx, [esp + 0x10]
call fcn.0044d1e8
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::TrimRight
push 0x20
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [esp + 0x18]
xor edi, edi
test eax, eax
jle 0x4017d6
mov edx, dword [esi + 0x20]
push 0
push edi
push 0x150
push edx
call ebp
test eax, eax
je 0x4017cd
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::CString_5
lea eax, [esp + 0x14]
mov ecx, esi
push eax
push edi
mov byte [esp + 0x40], 2
call sub.MFC42u.DLL_CComboBox::GetLBText
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
test eax, eax
je 0x4017b1
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42u.DLL_CString::operator_2
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x40176b
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x44]
call sub.MFC42u.DLL_CString::operator_3
lea ecx, [esp + 0xc]
mov dword [esi + 0x48], 1
mov byte [esp + 0x38], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
pop ebp
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x40d820
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x44f746
push eax
mov eax, 0x500c
mov dword fs:[0], esp
call fcn.0044d980
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xba0]
mov ecx, edi
call sub.MFC42u.DLL_CMenu::DestroyMenu
push 0x94
push 4
push 0x94
call sub.MFC42u.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
push eax
mov ecx, edi
call sub.MFC42u.DLL_CMenu::Attach
mov eax, dword [esi + 0xba4]
xor edi, edi
push edi
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call sub.MFC42u.DLL_CMenu::FromHandle
mov ecx, dword [eax + 4]
push 0x400
push edi
push ecx
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_DeleteMenu]
mov edx, dword [0x47106c]
lea eax, [esp + 0x1c]
push edx
push 0x27ff
push eax
push 0x46643c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
lea ecx, [esp + 0x1c]
push ecx
mov word [esp + eax*2 + 0x20], di
mov ebp, 0x1389
lea esi, [esp + 0x20]
call ebx
add esp, 4
test eax, eax
jbe 0x40d98b
push esi
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::CString_4
push 0x3d
lea ecx, [esp + 0x14]
mov dword [esp + 0x5028], 0
call sub.MFC42u.DLL_CString::Find_1
lea edx, [esp + 0x18]
push eax
push edx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5028], 1
call sub.MFC42u.DLL_CString::operator_3
lea ecx, [esp + 0x18]
mov byte [esp + 0x5024], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::TrimRight
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, ebp
push ecx
push eax
mov eax, dword [edx + 4]
push 0
push eax
inc ebp
call dword [sym.imp.USER32.dll_AppendMenuW]
push esi
call ebx
lea edi, [edi + eax + 1]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x5024], 0xffffffff
lea esi, [esp + edi*2 + 0x1c]
call sub.MFC42u.DLL_CString::CString
push esi
call ebx
add esp, 4
test eax, eax
ja 0x40d8de
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
push 0x4701fc
push ebp
mov ecx, dword [esi + 4]
push 0x800
push ecx
call edi
mov edx, dword [esi + 4]
push 0x466d78
push 0x1388
push 0
push edx
call edi
mov ecx, dword [esp + 0x501c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5018
ret
Function at 0x40e810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44f9b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
lea ecx, [esp + 4]
mov dword [esp + 0xc], 0
call sub.MFC42u.DLL_CString::CString_5
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call sub.MFC42u.DLL_CString::CString_5
push 0x4662f8
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 2
call fcn.0044d320
push str.___s
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
push 0x4662f8
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
push str.Content_Disposition:_form_data__name_upload_
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
push 0x467058
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
push str.hello
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
push 0x4662f8
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
push str.___s__
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
push 0x4662f8
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov edx, ecx
push ecx
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
call sub.MFC42u.DLL_CString::Format
mov esi, dword [esp + 0x30]
add esp, 0x10
lea edx, [esp + 8]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x18], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x422020
Capabilities:
Create thread
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x451bc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
call fcn.00430450
mov ecx, dword [esi + 4]
mov edi, eax
push edi
push ecx
call sub.lua51.dll_luaL_loadfile
push edi
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x10
cmp ebp, ebx
je 0x4220d4
mov edx, dword [esi + 4]
push ebx
push 0xffffffffffffffff
push edx
call sub.lua51.dll_lua_tolstring
add esp, 0xc
lea ecx, [esp + 0x28]
push eax
call fcn.0044d46a
mov eax, dword [eax]
push ebx
push 0x10
push eax
mov byte [esp + 0x28], 1
call sub.MFC42u.DLL_AfxMessageBox
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], bl
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esi + 4]
push 0xfffffffffffffffe
push eax
call sub.lua51.dll_lua_settop
add esp, 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4220f7
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
mov dword [esi + 8], ebx
call fcn.00421c10
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push edx
push ebx
push esi
push 0x421ed0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x422120
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov esi, dword [esi + 8]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x422150
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebp
mov ebp, ecx
mov dword [esp + 4], ebp
mov eax, dword [ebp + 8]
test eax, eax
je 0x422267
push esi
mov esi, dword [0x4711f8]
test esi, esi
je 0x422242
push ebx
push edi
mov eax, esi
mov edi, esi
mov esi, dword [esi]
mov ebx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 4]
xor ebp, ebp
cdq
cmp ecx, eax
jne 0x422232
cmp ebp, edx
jne 0x422232
mov ecx, ebx
call fcn.00422150
cmp ebx, ebp
je 0x4221a9
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
cmp edi, dword [0x4711f8]
jne 0x4221bb
mov ecx, dword [edi]
mov dword [0x4711f8], ecx
jmp 0x4221c2
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
cmp edi, dword [0x4711fc]
jne 0x4221d5
mov ecx, dword [edi + 4]
mov dword [0x4711fc], ecx
jmp 0x4221dd
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [0x471204]
mov dword [edi], ecx
mov eax, dword [0x471200]
dec eax
mov dword [0x471204], edi
mov dword [0x471200], eax
jne 0x422234
mov eax, dword [0x4711f8]
cmp eax, ebp
je 0x422207
mov eax, dword [eax]
cmp eax, ebp
jne 0x422201
mov ecx, dword [0x471208]
mov dword [0x471200], ebp
mov dword [0x471204], ebp
mov dword [0x4711fc], ebp
mov dword [0x4711f8], ebp
call sub.MFC42u.DLL_CPlex::FreeDataChain
mov dword [0x471208], ebp
jmp 0x422234
xor ebp, ebp
cmp esi, ebp
mov ebp, dword [esp + 0x10]
jne 0x422174
pop edi
pop ebx
mov ecx, ebp
call fcn.00421c10
mov edx, dword [ebp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], 0
pop esi
pop ebp
pop ecx
ret
Function at 0x42f410
Capabilities:
Get file version info

Disassembly:
sub esp, 0x214
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
mov word [ebx + 0x3e], 0x4e4
je 0x42f42a
lea edi, [ebx + 4]
jmp 0x42f42c
xor edi, edi
mov ecx, 0xd
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x224]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
ja 0x42f479
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x214
ret 4
push esi
call sub.MFC42u.DLL_operatornew
add esp, 4
lea edx, [esp + 0x18]
mov dword [ebx + 0x38], eax
push eax
push esi
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x42f4a3
pop edi
pop esi
pop ebx
add esp, 0x214
ret 4
mov edx, dword [ebx + 0x38]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x4655f4
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x42f4cb
pop edi
pop esi
pop ebx
add esp, 0x214
ret 4
test ebx, ebx
je 0x42f4d4
lea edi, [ebx + 4]
jmp 0x42f4d6
xor edi, edi
mov esi, dword [esp + 0xc]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0x38]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push ecx
push str.VarFileInfoTranslation
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42f50d
cmp dword [esp + 0x10], 4
jb 0x42f50d
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [ebx + 0x3c], ecx
mov ecx, dword [ebx + 4]
xor eax, eax
cmp ecx, 0xfeef04bd
pop edi
pop esi
pop ebx
sete al
add esp, 0x214
ret 4

Function at 0x42fab0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push eax
push 0x28
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42fad3
xor esi, esi
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0xc]
neg ecx
sbb ecx, ecx
push edx
and ecx, 2
push 0x46edf8
push 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 4]
push 0
push 0
lea eax, [esp + 0x10]
push 0x10
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42fb20
xor esi, esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x42fc00
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1418
call fcn.0044d980
mov eax, dword [esp + 0x141c]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 8], edi
jne 0x42fc26
xor eax, eax
pop edi
add esp, 0x1418
ret
push ebx
push ebp
lea ecx, [esp + 0xc]
push esi
push ecx
lea edx, [esp + 0x42c]
push 0x1000
push edx
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x42fcd8
test dword [esp + 0x10], 0xfffffffc
jbe 0x42fcd8
mov ebx, dword [esp + 0x1430]
mov ebp, dword [sym.imp.MSVCRT.dll__wcsicmp]
lea esi, [esp + 0x428]
mov ecx, dword [esi]
mov edx, dword [esp + 0x142c]
lea eax, [esp + 0x18]
push 0x208
push eax
push ecx
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x42fcaf
lea eax, [esp + 0x220]
push 1
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.0042fb40
lea edx, [esp + 0x22c]
push edx
push ebx
call ebp
add esp, 0x14
test eax, eax
je 0x42fccd
mov eax, dword [esp + 0x10]
inc edi
shr eax, 2
add esi, 4
cmp edi, eax
jb 0x42fc6b
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x1418
ret
mov ecx, dword [esp + edi*4 + 0x428]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x1418
ret

Function at 0x42fdc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x453c2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push 0x4701fc
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0x30
mov word [esp + 0x12], 0x31
mov word [esp + 0x14], 0x32
mov word [esp + 0x16], 0x33
mov word [esp + 0x18], 0x34
mov word [esp + 0x1a], 0x35
mov word [esp + 0x1c], 0x36
mov word [esp + 0x1e], 0x37
mov word [esp + 0x20], 0x38
mov word [esp + 0x22], 0x39
mov word [esp + 0x24], 0x41
mov word [esp + 0x26], 0x42
mov word [esp + 0x28], 0x43
mov word [esp + 0x2a], 0x44
mov word [esp + 0x2c], 0x45
mov word [esp + 0x2e], 0x46
call sub.MFC42u.DLL_CString::CString_4
mov esi, dword [esp + 0x40]
mov dword [esp + 0x34], 1
and esi, 0xff
mov eax, esi
shr eax, 4
mov cx, word [esp + eax*2 + 0xc]
push ecx
lea ecx, [esp + 8]
call fcn.0044d1e8
and esi, 0xf
lea ecx, [esp + 4]
mov dx, word [esp + esi*2 + 0xc]
push edx
call sub.MFC42u.DLL_CString::operator_1
mov esi, dword [esp + 0x3c]
lea eax, [esp + 4]
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x34], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x42ff00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x453c50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0
call fcn.0044d302
mov eax, dword [esp + 0x30]
push 0
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call sub.MFC42u.DLL_CFileFind::FindFile
lea ecx, [esp + 4]
mov esi, eax
call sub.MFC42u.DLL_CFileFind::Close
lea ecx, [esp + 4]
mov byte [esp + 0x28], 0
call sub.MFC42u.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x42ffc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x210]
push edi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 8
cmp word [esp + 8], 0
je 0x43001a
push esi
lea eax, [esp + 0xc]
lea esi, [esp + 0xc]
cmp word [eax], 0x5c
jne 0x43000e
lea ecx, [esp + 0xc]
push 0
push ecx
mov word [esi], 0
call edi
mov word [esi], 0x5c
add esi, 2
mov eax, esi
cmp word [esi], 0
jne 0x42fff5
pop esi
lea edx, [esp + 8]
push 0
push edx
call edi
push ebx
call fcn.0042ff80
add esp, 4
pop edi
pop ebx
add esp, 0x208
ret
Function at 0x4308d0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x453d6b
push eax
mov eax, 0x2210
mov dword fs:[0], esp
call fcn.0044d980
mov eax, dword [0x471074]
push esi
push 0x4701fc
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43093b
mov esi, dword [esp + 0x2224]
push 0x471074
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x2210]
mov dword fs:[0], ecx
add esp, 0x221c
ret
mov eax, dword [0x4710ac]
push edi
test eax, eax
je 0x430a29
lea ecx, [esp + 0xc]
lea edx, [esp + 0x218]
push ecx
push 0x800
push edx
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x430a29
mov eax, dword [esp + 0xc]
xor esi, esi
test eax, eax
jbe 0x430a29
lea edi, [esp + 0x218]
mov ecx, dword [edi]
mov edx, dword [0x4710ac]
lea eax, [esp + 0x10]
push 0x104
push eax
push ecx
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x4309e4
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 8]
mov dword [esp + 0x2220], 0
call sub.MFC42u.DLL_CString::MakeLower
push 0x4654b8
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
jg 0x4309f2
lea ecx, [esp + 8]
mov dword [esp + 0x2220], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0xc]
inc esi
add edi, 4
cmp esi, eax
jb 0x43097e
jmp 0x430a29
lea ecx, [esp + 0x10]
push 1
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.0042fbb0
add esp, 0xc
lea eax, [esp + 0x10]
mov ecx, 0x471074
push eax
call fcn.0044d320
lea ecx, [esp + 8]
mov dword [esp + 0x2220], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov esi, dword [esp + 0x2228]
push 0x471074
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov ecx, dword [esp + 0x2218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x221c
ret