joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4195a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, 1
test eax, eax
je 0x4195ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 8]
jae 0x4195de
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
je 0x4195e0
jmp 0x4195ea
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4195b2
mov esp, ebp
pop ebp
ret 4

Function at 0x419760
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x463470]
mov dword [ebp - 4], eax
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x41978f
jmp 0x41984f
mov dword [ebp - 0x130], 0x128
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x138]
call fcn.00404930
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x419837
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x138]
call fcn.00404710
test eax, eax
jne 0x419820
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x419820
push 0xffffffffffffffff
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4197ce
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x138]
call fcn.004027a0
mov ecx, dword [ebp - 4]
call fcn.0042e97e
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x419860
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x463470]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x138], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x41989b
xor eax, eax
jmp 0x41993d
mov dword [ebp - 0x130], 0x128
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00404930
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x419913
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00404710
test eax, eax
jne 0x4198fc
mov dword [ebp - 0x138], 1
jmp 0x419913
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4198da
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x140], ecx
lea ecx, [ebp - 0x13c]
call fcn.004027a0
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 4]
call fcn.0042e97e
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41a890
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x41a8a4
jmp 0x41a8c8
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x41a8c8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0xc], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41d360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x41d379
mov ecx, dword [ebp - 0x10]
call fcn.0041d8b0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x40], 0xffffffff
jne 0x41d3b2
xor eax, eax
jmp 0x41d4ee
push 8
push 0x4517e8
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call fcn.0042e1d0
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0x4000
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], 0
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x48], eax
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
push 0x2c
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0xc], 0x2c
je 0x41d44e
jmp 0x41d4ad
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041dc70
mov dword [ebp - 8], eax
push 0
push 0
mov edx, dword [ebp - 8]
add edx, 0x100
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41d48f
jmp 0x41d4ad
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00406150
mov dword [ebp - 4], 1
xor edx, edx
jne 0x41d380
cmp dword [ebp - 4], 0
jne 0x41d4d3
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x40], 0xffffffff
je 0x41d4d3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x40], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x10]
call fcn.0041dcc0
mov ecx, dword [ebp - 0x10]
call fcn.0041dd10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41d930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x41d948
xor eax, eax
jmp 0x41da36
mov dword [ebp - 4], 0
push 0
push 0
push 0x100
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406170
push eax
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.004061b0
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406170
cmp dword [ebp - 4], eax
je 0x41d9e2
push 0
call fcn.00424170
add esp, 4
movzx eax, al
test eax, eax
jne 0x41d9b5
jmp 0x41d9de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CBitmapFile::Read
push 0xf7
push 0x451b08
push 0
call fcn.00424190
add esp, 0xc
push eax
call fcn.004240d0
add esp, 0xc
xor eax, eax
jmp 0x41da36
mov dword [ebp - 8], 0
jmp 0x41d9f4
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406170
cmp dword [ebp - 8], eax
jge 0x41da31
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.004061b0
movzx eax, byte [eax]
cmp eax, 0xff
je 0x41da2f
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.004061b0
mov byte [eax], 0
jmp 0x41d9eb
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41da40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x41da58
xor eax, eax
jmp 0x41db81
mov dword [ebp - 4], 0
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx + 0x48]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x2c
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], 0x2c
je 0x41dae9
push 0
call fcn.00424170
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x41dab9
jmp 0x41dae2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CBitmapFile::Write_
push 0x117
push 0x451b70
push 0
call fcn.00424190
add esp, 0xc
push eax
call fcn.004240d0
add esp, 0xc
xor eax, eax
jmp 0x41db81
push 0
push 0
push 0x100
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x30
call fcn.00406170
push eax
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x30
call fcn.004061b0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call fcn.00406170
cmp dword [ebp - 4], eax
je 0x41db7c
push 0
call fcn.00424170
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x41db4f
jmp 0x41db78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CBitmapFile::Write_BITMAP
push 0x11f
push str.New_LoginGuaGua_trunkClientOnlineSetupV2CommonBitmapFile.cpp
push 0
call fcn.00424190
add esp, 0xc
push eax
call fcn.004240d0
add esp, 0xc
xor eax, eax
jmp 0x41db81
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x423990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c886
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x74], 0
jne 0x4239be
xor eax, eax
jmp 0x423b08
push 1
mov ecx, dword [ebp - 0x3c]
add ecx, 0x50
push ecx
lea ecx, [ebp - 0x18]
call fcn.004251de
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
call fcn.0041e430
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x423a05
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00409390
mov eax, dword [ebp - 0x30]
jmp 0x423b08
mov dword [ebp - 0x28], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x28]
je 0x423ab5
push 0
call fcn.00424170
add esp, 4
movzx edx, al
test edx, edx
jne 0x423a65
jmp 0x423a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.COutputFile::WriteData__I64d___d_
push 0xa3
push str.New_LoginGuaGua_trunkClientOnlineSetupV2CommonOutputFile.cpp
push 0
call fcn.00424190
add esp, 0xc
push eax
call fcn.004240d0
add esp, 0x18
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00409390
mov eax, dword [ebp - 0x34]
jmp 0x423b08
push 0xff
mov ecx, dword [ebp - 0x3c]
call fcn.0041e430
cdq
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042f530
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.0041dbf0
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp - 0x3c]
call fcn.0041db90
mov ecx, dword [ebp - 0x3c]
call fcn.0041da40
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00409390
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42567e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4256d1
call fcn.004475b6
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4256d1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4256c7
xor eax, eax
jmp 0x4257ea
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x425701
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x425701
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4257e7
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x42572e
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0042637d
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4257e7
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x425777
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x425777
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x425771
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0042637d
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4257d7
and dword [ebp + 0xc], 0
jmp 0x4257d7
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4257d7
push 0xc
call fcn.00441017
mov esi, eax
test esi, esi
pop ecx
je 0x4257b9
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4257bb
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4257d2
push dword [ebp - 8]
call fcn.0043c082
jmp 0x4257d7
call fcn.0043c059
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x42573c
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42f306
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x42f323
call fcn.004313c7
mov dword [eax], 0x16
xor eax, eax
jmp 0x42f38d
push esi
push 0x8c
push 1
call fcn.00431f77
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x42f378
push esi
call fcn.00433691
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x42f356
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x42f271
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x42f38c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0042f128
test ebx, ebx
pop ecx
je 0x42f38a
push ebx
call fcn.004313d9
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42f391
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0042f1a0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42f42c
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x467750]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x42f42c
cmp eax, 1
je 0x42f44d
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42f42c
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x42f3f9
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x42f428
xor eax, eax
inc eax
jmp 0x42f46c
cmp edi, eax
jae 0x42f430
xor eax, eax
jmp 0x42f46c
cmp eax, esi
jae 0x42f437
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x467750]
jmp 0x42f450
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42fc21
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x456268
call fcn.004304a0
mov edi, 0x94
mov eax, edi
call fcn.0042f1a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x467750], ecx
mov eax, dword [esi + 4]
mov dword [0x46775c], eax
mov edx, dword [esi + 8]
mov dword [0x467760], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x467754], esi
cmp ecx, 2
je 0x42fc81
or esi, 0x8000
mov dword [0x467754], esi
shl eax, 8
add eax, edx
mov dword [0x467758], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x42fcbc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42fcbc
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x42fcd4
cmp eax, 0x20b
je 0x42fcc1
mov dword [ebp - 0x1c], esi
jmp 0x42fce8
cmp dword [ecx + 0x84], 0xe
jbe 0x42fcbc
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x42fce2
cmp dword [ecx + 0x74], 0xe
jbe 0x42fcbc
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004321d0
pop ecx
test eax, eax
jne 0x42fcfc
push 0x1c
call fcn.0042fbfd
pop ecx
call fcn.0043388b
test eax, eax
jne 0x42fd0d
push 0x10
call fcn.0042fbfd
pop ecx
call fcn.00437882
mov dword [ebp - 4], esi
call fcn.00437684
test eax, eax
jge 0x42fd26
push 0x1b
call fcn.0042fbd8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x469050], eax
call fcn.00437562
mov dword [0x46773c], eax
call fcn.004374c0
test eax, eax
jge 0x42fd4c
push 8
call fcn.0042fbd8
pop ecx
call fcn.0043728d
test eax, eax
jge 0x42fd5d
push 9
call fcn.0042fbd8
pop ecx
push 1
call fcn.004300aa
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x42fd73
push eax
call fcn.0042fbd8
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00437230
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x42fd94
movzx eax, word [ebp - 0x40]
jmp 0x42fd97
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0043b960
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x42fdb5
push edi
call fcn.004301d7
call fcn.004301f9
jmp 0x42fde7
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004304db
ret
Function at 0x430114
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4562a0
call fcn.004304a0
push 8
call fcn.00432185
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x467790], esi
jne 0x430148
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x46778c], esi
mov al, byte [ebp + 0x10]
mov byte [0x467788], al
cmp dword [ebp + 0xc], edi
jne 0x430192
cmp dword [0x469048], edi
je 0x430182
mov eax, dword [0x469044]
sub eax, 4
mov dword [0x469044], eax
cmp eax, dword [0x469048]
jb 0x430182
mov eax, dword [eax]
cmp eax, edi
je 0x430163
call eax
jmp 0x430163
push 0x462098
mov eax, 0x462090
call fcn.00430092
pop ecx
push 0x4620a4
mov eax, 0x46209c
call fcn.00430092
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4301c3
cmp dword [ebp + 0x10], edi
jne 0x4301d1
mov dword [0x467790], esi
push dword [ebp + 8]
call fcn.00430050
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4301d0
push 8
call fcn.004320d0
pop ecx
ret
call fcn.004304db
ret
Function at 0x434b46
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x434b74
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x434b7b
cmp ebx, dword [eax + 4]
jae 0x434b7b
xor eax, eax
jmp 0x434d6b
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x434b8c
xor eax, eax
inc eax
jmp 0x434d6a
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x434ba2
cmp ecx, edx
jae 0x434ce7
cmp dword [eax + 4], 0
je 0x434bab
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x434b93
cmp dword [ebp + 8], 0
je 0x434bcd
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x434ce7
cmp eax, esi
jae 0x434ce7
mov eax, dword [0x467910]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x434bf2
cmp dword [esi*4 + 0x467918], edi
je 0x434ceb
inc esi
cmp esi, eax
jl 0x434be0
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x434d67
cmp dword [ebp - 8], 0x1000000
jne 0x434d67
test byte [ebp - 0xc], 0xcc
je 0x434c70
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x434d67
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x434d67
cmp word [eax + 0x18], 0x10b
jne 0x434d67
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x434d67
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x434c70
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x434c70
test byte [ecx + 0x27], 0x80
jne 0x434ce7
push 1
push 0x467958
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x434b84
mov ecx, dword [0x467910]
test ecx, ecx
mov edx, ecx
jle 0x434ca4
lea eax, [ecx*4 + 0x467914]
cmp dword [eax], edi
je 0x434ca4
dec edx
sub eax, 4
test edx, edx
jg 0x434c98
test edx, edx
jne 0x434cd5
push 0xf
pop ebx
cmp ecx, ebx
jg 0x434cb1
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x434cc9
lea eax, [edx*4 + 0x467918]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x434cb7
cmp ecx, 0x10
jge 0x434cd5
inc ecx
mov dword [0x467910], ecx
push 0
push 0x467958
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x434b84
xor eax, eax
jmp 0x434d6a
test esi, esi
jle 0x434b84
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x467958
call ebx
test eax, eax
jne 0x434b84
cmp dword [esi*4 + 0x467918], edi
je 0x434d41
mov eax, dword [0x467910]
lea esi, [eax - 1]
test esi, esi
jl 0x434d2f
cmp dword [esi*4 + 0x467918], edi
je 0x434d2b
dec esi
jns 0x434d1f
test esi, esi
jge 0x434d3f
cmp eax, 0x10
jge 0x434d3a
inc eax
mov dword [0x467910], eax
lea esi, [eax - 1]
jmp 0x434d41
je 0x434d59
xor ecx, ecx
test esi, esi
jl 0x434d59
lea eax, [ecx*4 + 0x467918]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x434d47
push 0
push 0x467958
call ebx
jmp 0x434b84
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret