joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420dbe
Capabilities:
Delete file
Move file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x108], ecx
mov eax, dword [ebp + 8]
cmp dword [eax], 1
jne 0x420e14
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push 0x4c78a8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
mov edx, dword [ebp + 8]
add edx, 4
push edx
push 0x4c78d8
push SysReAllocStringLen
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
jmp 0x420fb3
mov eax, dword [ebp + 8]
cmp dword [eax], 2
jne 0x420e94
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push 0x4c7908
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
mov edx, dword [ebp + 8]
add edx, 4
push edx
push 0x4c7950
push SysReAllocStringLen
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
mov eax, dword [ebp + 8]
add eax, 4
push eax
push 0x4c7998
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea edx, [ebp - 0x104]
push edx
push SysReAllocStringLen
call fcn.0043ed70
mov ecx, eax
call fcn.0043f24c
jmp 0x420fb3
mov eax, dword [ebp + 8]
cmp dword [eax], 4
jne 0x420eda
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push 0x4c79a4
push 0x104
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
push SysReAllocStringLen
call fcn.0043ed70
mov ecx, eax
call fcn.0043f24c
jmp 0x420fb3
mov ecx, dword [ebp + 8]
cmp dword [ecx], 8
jne 0x420f72
mov edx, dword [ebp + 8]
add edx, 4
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_s
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f24c
lea edx, [ebp - 0x104]
push edx
push SysReAllocStringLen
call fcn.0043ed70
mov ecx, eax
call fcn.0043f24c
mov eax, dword [ebp + 8]
add eax, 4
push eax
push 0x4c7a00
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea edx, [ebp - 0x104]
push edx
push SysReAllocStringLen
call fcn.0043ed70
mov ecx, eax
call fcn.0043f24c
jmp 0x420fb3
mov eax, dword [ebp + 8]
cmp dword [eax], 0x20
jne 0x420fb3
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push 0x4c7a0c
push 0x104
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f24c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
call fcn.00420d82
test eax, eax
je 0x42100a
mov ecx, dword [ebp + 8]
add ecx, 0x108
push ecx
call dword [0x54b4b8]
test eax, eax
jne 0x42100a
cmp dword [ebp + 0xc], 0
je 0x42100a
push 0x80
mov edx, dword [ebp + 8]
add edx, 0x108
push edx
call dword [0x54b4e0]
push 4
push 0
mov eax, dword [ebp + 8]
add eax, 0x108
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x42100f
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x421015
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov dword [ebp - 0x464], ecx
mov dword [ebp - 0x314], 0x10000
mov byte [ebp - 0x20c], 0
mov byte [ebp - 0x310], 0
mov dword [ebp - 0x318], 0
jmp 0x421057
mov eax, dword [ebp - 0x318]
add eax, 1
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jge 0x4211d6
mov ecx, dword [ebp - 0x318]
mov dword [ebp - 0x468], ecx
cmp dword [ebp - 0x468], 0
je 0x421084
cmp dword [ebp - 0x468], 1
je 0x4210a4
jmp 0x4210c4
push 0
push 7
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4210a2
mov byte [ebp - 0x20c], 0
jmp 0x4210cb
push 0
push 0x18
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4210c2
mov byte [ebp - 0x20c], 0
jmp 0x4210cb
mov byte [ebp - 0x20c], 0
movsx ecx, byte [ebp - 0x20c]
test ecx, ecx
je 0x4211d1
lea edx, [ebp - 0x20c]
push edx
call sub.ntdll.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x20c]
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x31c]
movsx edx, byte [ecx - 1]
cmp edx, 0x5c
je 0x42111d
mov eax, dword [ebp - 0x31c]
mov byte [eax], 0x5c
mov ecx, dword [ebp - 0x31c]
add ecx, 1
mov dword [ebp - 0x31c], ecx
push 0x4c7a34
mov edx, dword [ebp - 0x31c]
push edx
call sub.ntdll.dll_strcpy
add esp, 8
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [0x54b4e8]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xffffffff
je 0x4211d1
mov edx, dword [ebp - 0x460]
and edx, 0x10
test edx, edx
jne 0x4211ac
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x31c]
push ecx
call sub.ntdll.dll_strcpy
add esp, 8
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x310]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x314]
push ecx
mov edx, dword [ebp - 0x464]
add edx, 0x84
push edx
mov ecx, dword [ebp - 0x464]
call fcn.00422310
lea eax, [ebp - 0x460]
push eax
mov ecx, dword [ebp - 0x320]
push ecx
call dword [0x54b4b4]
test eax, eax
jne 0x421154
mov edx, dword [ebp - 0x320]
push edx
call dword [0x54b4c8]
jmp 0x421048
mov ecx, dword [ebp - 0x464]
add ecx, 0x84
call fcn.004229e0
mov esp, ebp
pop ebp
ret
Function at 0x4219c4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x318], 8
mov byte [ebp - 0x210], 0
mov byte [ebp - 0x314], 0
mov dword [ebp - 4], 0
jmp 0x4219fd
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jae 0x421b9d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x4b0480]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x320]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x4b0480]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f434
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jne 0x421b98
mov dword [ebp - 0x324], 0
mov eax, 1
test eax, eax
je 0x421b85
push 0x104
lea ecx, [ebp - 0x314]
push ecx
mov edx, dword [ebp - 0x324]
push edx
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
je 0x421a9c
jmp 0x421b85
movsx ecx, byte [ebp - 0x314]
cmp ecx, 0x7b
jne 0x421b71
lea edx, [ebp - 0x314]
push edx
push 0x4c7bd4
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x428]
push edx
push SysReAllocStringLen
call fcn.0043ed70
mov ecx, eax
call fcn.0043f434
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jne 0x421b71
mov dword [ebp - 0x42c], 0x104
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x430]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f45b
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jne 0x421b5e
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [ebp - 0x434]
add ecx, 0x34
push ecx
mov ecx, dword [ebp - 0x434]
call fcn.00422310
mov edx, dword [ebp - 0x430]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
mov eax, dword [ebp - 0x324]
add eax, 1
mov dword [ebp - 0x324], eax
jmp 0x421a5b
mov ecx, dword [ebp - 0x320]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
jmp 0x4219f4
mov ecx, dword [ebp - 0x434]
add ecx, 0x34
call fcn.004229e0
mov esp, ebp
pop ebp
ret
Function at 0x421bbc
Capabilities:
Get common file path
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x314], 0x40
mov byte [ebp - 0x310], 0
mov byte [ebp - 0x20c], 0
mov dword [ebp - 4], reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x31c]
push eax
push 0x20019
push 0
push 0x4c7bec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f434
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
jne 0x421e32
mov dword [ebp - 0x52c], 0x208
mov dword [ebp - 0x634], 0
mov byte [ebp - 0x524], 0
lea ecx, [ebp - 0x52c]
push ecx
lea edx, [ebp - 0x524]
push edx
lea eax, [ebp - 0x528]
push eax
push 0
push 0x4c7c24
mov ecx, dword [ebp - 0x31c]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f45b
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xea
jne 0x421cd3
mov edx, dword [ebp - 0x52c]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x634], eax
lea ecx, [ebp - 0x52c]
push ecx
mov edx, dword [ebp - 0x634]
push edx
lea eax, [ebp - 0x528]
push eax
push 0
push 0x4c7c34
mov ecx, dword [ebp - 0x31c]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f45b
mov dword [ebp - 0x318], eax
mov edx, dword [ebp - 0x31c]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
cmp dword [ebp - 0x318], 0
jne 0x421e0e
push 0x104
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x634], 0
jne 0x421d1c
lea ecx, [ebp - 0x524]
mov dword [ebp - 0x64c], ecx
jmp 0x421d28
mov edx, dword [ebp - 0x634]
mov dword [ebp - 0x64c], edx
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x421e0e
mov ecx, dword [ebp - 0x638]
movsx edx, byte [ecx]
test edx, edx
je 0x421e0e
push 0x2c
mov eax, dword [ebp - 0x638]
push eax
call fcn.00422930
add esp, 8
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0
je 0x421d8a
mov ecx, dword [ebp - 0x63c]
mov byte [ecx], 0
mov edx, dword [ebp - 0x63c]
add edx, 1
mov dword [ebp - 0x63c], edx
mov eax, dword [ebp - 0x638]
push eax
lea ecx, [ebp - 0x630]
push ecx
push 0x4c7c44
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [0x54b4f0]
and eax, 0x10
test eax, eax
jne 0x421dfd
push 0x104
mov ecx, dword [ebp - 0x638]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.00422950
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
mov ecx, dword [ebp - 0x648]
add ecx, 0x64
push ecx
mov ecx, dword [ebp - 0x648]
call fcn.00422310
mov edx, dword [ebp - 0x63c]
mov dword [ebp - 0x638], edx
jmp 0x421d34
cmp dword [ebp - 0x634], 0
je 0x421e32
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x644], eax
mov ecx, dword [ebp - 0x644]
push ecx
call fcn.004aa2c8
add esp, 4
mov ecx, dword [ebp - 0x648]
add ecx, 0x64
call fcn.004229e0
mov esp, ebp
pop ebp
ret
Function at 0x421e44
Capabilities:
Get common file path
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
mov dword [ebp - 0x534], ecx
push 0x104
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x314], 0x20
mov byte [ebp - 0x310], 0
mov byte [ebp - 0x20c], 0
mov dword [ebp - 4], reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x420]
push ecx
push 0x20019
push 0
push 0x4c7c4c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f434
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x422055
mov dword [ebp - 0x424], 0
mov edx, 1
test edx, edx
je 0x422042
push 0x104
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x421f06
jmp 0x422042
lea eax, [ebp - 0x310]
push eax
push 0x4c7c70
push 0x104
lea ecx, [ebp - 0x528]
push ecx
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea edx, [ebp - 0x52c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x528]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f434
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x42202e
mov dword [ebp - 0x530], 0x104
lea ecx, [ebp - 0x530]
push ecx
lea edx, [ebp - 0x20c]
push edx
push 0
push 0
push 0x4c7c98
mov eax, dword [ebp - 0x52c]
push eax
call fcn.0043ed70
mov ecx, eax
call fcn.0043f45b
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x421fc1
lea ecx, [ebp - 0x314]
push ecx
mov edx, dword [ebp - 0x534]
add edx, 0x54
push edx
mov ecx, dword [ebp - 0x534]
call fcn.00422310
jmp 0x42201b
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x418]
push ecx
push 0x4c7ca4
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x534]
call fcn.00422866
test eax, eax
je 0x42201b
lea ecx, [ebp - 0x314]
push ecx
mov edx, dword [ebp - 0x534]
add edx, 0x54
push edx
mov ecx, dword [ebp - 0x534]
call fcn.00422310
mov eax, dword [ebp - 0x52c]
push eax
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
jmp 0x421ec5
mov edx, dword [ebp - 0x420]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
mov ecx, dword [ebp - 0x534]
add ecx, 0x54
call fcn.004229e0
mov esp, ebp
pop ebp
ret
Function at 0x426a88
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 8], 0
jne 0x426aa5
mov eax, 8
jmp 0x426bca
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x426abd
mov eax, 6
jmp 0x426bca
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocStringLen
mov edx, dword [ebp + 8]
push edx
call dword [0x54b4dc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x426afc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
xor eax, eax
jmp 0x426bca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x426b17
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
xor eax, eax
jmp 0x426bca
push 0
push 0x80
push 3
push 0
push 7
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [0x54b4dc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x426b53
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
xor eax, eax
jmp 0x426bca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x426b6b
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
xor eax, eax
jmp 0x426bca
push 0
push 0x80
push 3
push 0
push 7
push 0x10000
mov ecx, dword [ebp + 8]
push ecx
call dword [0x54b4dc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x426ba7
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
xor eax, eax
jmp 0x426bca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x426bbf
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
xor eax, eax
jmp 0x426bca
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x427a6d
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
push 0x4c90ec
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x427a8f
xor eax, eax
jmp 0x427af8
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
push 0
call fcn.004274b5
add esp, 8
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4282b7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x108], ecx
cmp dword [0x54b52c], 0
je 0x4282d9
mov eax, 1
jmp 0x42843b
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.AntiRk.dll
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00408000
lea edx, [ebp - 0x104]
push edx
mov ecx, dword [ebp - 0x108]
call fcn.0042823d
test eax, eax
jne 0x42831e
xor eax, eax
jmp 0x42843b
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x108]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x108]
cmp dword [edx + 0x10], 0
jne 0x428347
xor eax, eax
jmp 0x42843b
push 0x4ca3c0
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x108]
mov dword [edx], eax
mov eax, dword [ebp - 0x108]
cmp dword [eax], 0
jne 0x428376
xor eax, eax
jmp 0x42843b
push 0x4ca3cc
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x108]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x108]
cmp dword [edx + 4], 0
jne 0x4283a7
xor eax, eax
jmp 0x42843b
push 0x4ca3dc
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x108]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x108]
cmp dword [eax + 8], 0
jne 0x4283d5
xor eax, eax
jmp 0x42843b
push 0x4ca3f0
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x108]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x108]
cmp dword [edx + 0xc], 0
jne 0x428403
xor eax, eax
jmp 0x42843b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x108]
call dword [edx + 8]
add esp, 8
test eax, eax
jne 0x42841f
xor eax, eax
jmp 0x42843b
mov eax, dword [ebp - 0x108]
mov dword [eax + 0x14], 1
mov dword [0x54b52c], 1
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x429168
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x429183
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x429187
xor eax, eax
jmp 0x4291d0
push 0x30
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004297bd
test eax, eax
jne 0x4291b1
xor eax, eax
jmp 0x4291d0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0xc58
call fcn.0042a3b0
test eax, eax
je 0x4291ce
mov eax, 1
jmp 0x4291d0
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4295d7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac78e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
add eax, 0x19b4
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x429618
xor eax, eax
jmp 0x4297ac
mov ecx, dword [ebp - 0x68]
add ecx, 0xc58
call fcn.00417170
push 0x4dc654
mov ecx, dword [ebp - 0x68]
add ecx, 0x19b4
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x42964e
xor eax, eax
jmp 0x4297ac
mov dword [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push eax
push 1
push 0x10
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x429696
mov dword [ebp - 0x5c], 1
push 0x4ba708
lea edx, [ebp - 0x5c]
push edx
call sub.MSVCRT.dll__CxxThrowException
cmp dword [ebp - 0x20], 0x21726152
jne 0x429750
cmp dword [ebp - 0x18], 0
je 0x429750
cmp dword [ebp - 0x18], 0
je 0x42973c
mov byte [ebp - 0x58], 0
mov ecx, 0xb
xor eax, eax
lea edi, [ebp - 0x57]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x24]
push eax
push 0x30
push 1
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x30
je 0x4296e6
jmp 0x42973c
mov dword [ebp - 0x28], 0
jmp 0x4296f8
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xc
jae 0x429714
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x58]
xor ecx, 0x12345678
mov edx, dword [ebp - 0x28]
mov dword [ebp + edx*4 - 0x58], ecx
jmp 0x4296ef
mov byte [ebp - 0x60], 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x68]
add ecx, 0xc58
call fcn.0042a2b0
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
jmp 0x4296ad
cmp dword [ebp - 0x18], 0
je 0x429750
mov ecx, dword [ebp - 0x68]
add ecx, 0xc58
call fcn.00417170
jmp 0x429771
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0x68]
add ecx, 0xc58
call fcn.0042a290
test eax, eax
jne 0x42979b
xor eax, eax
jmp 0x4297ac
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x18ac], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429835
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 0
je 0x42986a
mov dword [ebp - 0x10], SysReAllocStringLen
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], 4
jmp 0x42987f
mov dword [ebp - 0x10], 0xc0000000
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 6
push 0
push 0
push 3
push 0
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x429906
cmp dword [ebp + 0xc], 0
je 0x4298b7
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push 0
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x429906
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
jmp 0x429908
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42992b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0ce0
push 0x4a8984
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x5a4d
je 0x429984
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
jmp 0x4299e0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx], 0x4550
jne 0x4299a8
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jne 0x4299bb
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
jmp 0x4299e0
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
jmp 0x4299e0
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42ab6f
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x64], 0
je 0x42aba0
cmp dword [ebp + 8], 0
jne 0x42ab90
mov dword [ebp - 8], 0x54cfec
jmp 0x42ab96
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esp, ebp
pop ebp
ret 4