joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b930
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1084
call fcn.004d9670
push ebx
push ebp
mov ebp, dword [esp + 0x1090]
push esi
xor esi, esi
cmp ebp, esi
je 0x42ba33
cmp word [ebp], si
je 0x42ba33
mov ebx, dword [esp + 0x1098]
cmp ebx, esi
je 0x42ba33
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x42ba33
push edi
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x4e]
mov word [esp + 0x4c], si
push ebx
rep stosd dword es:[edi], eax
push 0x4f7624
push ebp
push str._tmp:
push 1
push 0x4f7658
push 7
stosw word es:[edi], ax
push str._tp:
push str._s_d__s_d__s_s__s_s
lea eax, [esp + 0x70]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x40]
add esp, 0x2c
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
lea ecx, [esp + 0x4c]
push edx
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x24], 0x515064
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], str.runas
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
je 0x42ba25
mov eax, dword [esp + 0x44]
push 0x186a0
push eax
mov esi, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1084
ret 8
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1084
ret 8
Function at 0x42bb30
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcaf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x870
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x46a]
mov word [ebp - 0x46c], si
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push 0x4f9e2c
lea eax, [ebp - 0x46c]
push 0x103
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [ebp - 0x264]
lea edx, [ebp - 0x46c]
mov word [ebp - 0x266], si
push ecx
push edx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x42bd3a
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [ebp - 0x238]
push 0x4f7314
push eax
call edi
add esp, 8
test eax, eax
je 0x42bd17
lea ecx, [ebp - 0x238]
push 0x4f9b08
push ecx
call edi
add esp, 8
test eax, eax
je 0x42bd17
test byte [ebp - 0x264], 0x10
je 0x42bc70
mov dx, word [0x514ff0]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x672]
mov word [ebp - 0x674], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x674]
push eax
push ebx
push 0x4f7884
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [ebp - 0x674]
push edx
call fcn.0042bb30
add esp, 0x18
cmp eax, esi
jne 0x42bd17
mov dword [ebp - 0x14], esi
jmp 0x42bd30
lea eax, [ebp - 0x238]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x42bd15
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
push str..exe
push esi
call edi
add esp, 8
test eax, eax
je 0x42bcbf
push str..dll
push esi
call edi
add esp, 8
test eax, eax
je 0x42bcbf
push str..ocx
push esi
call edi
add esp, 8
test eax, eax
jne 0x42bd15
mov cx, word [0x514ff0]
xor eax, eax
mov word [ebp - 0x87c], cx
mov ecx, 0x81
lea edi, [ebp - 0x87a]
lea edx, [ebp - 0x238]
rep stosd dword es:[edi], eax
push edx
push ebx
stosw word es:[edi], ax
push 0x4f7884
lea eax, [ebp - 0x87c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [ebp - 0x87c]
push ecx
call fcn.0048eed0
add esp, 0x18
test eax, eax
jne 0x42bd15
mov dword [ebp - 0x14], eax
jmp 0x42bd30
xor esi, esi
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x264]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42bbbd
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c2b0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 1
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x214]
push 0x103
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.004a5da0
add esp, 0x10
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
add esp, 0x208
ret
Function at 0x4311a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call fcn.00430f40
mov eax, dword [esi + 4]
push 0x3f0
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ebx, [esi + 0x1874]
mov ecx, ebx
call fcn.0041a5b0
lea edx, [ebx + 0x5d4e0]
mov ecx, 0x412
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x214]
push ecx
push 0x4f6170
push 0x824
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov dx, word [0x514ff0]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], dx
add esp, 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebp, [esi + 0xc]
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x18]
push 0x4f67ac
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea edx, [ebx + 0x5d0d0]
push ebp
mov ecx, 0x82
xor eax, eax
mov edi, edx
push 0x4f6170
push 0x104
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov esi, dword [esi + 4]
add esp, 0x10
mov ecx, ebx
mov dword [ebx + 0x269c], 0x431370
mov dword [ebx + 0x2698], esi
call fcn.0041a4e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x431680
Capabilities:
Delete file

Disassembly:
sub esp, 0x61c
push ebx
push ebp
mov ebp, dword [esp + 0x62c]
push esi
test ebp, ebp
push edi
mov dword [esp + 0x10], 0
je 0x43184a
mov ebx, dword [esp + 0x638]
test ebx, ebx
je 0x43184a
mov eax, dword [esp + 0x63c]
test eax, eax
je 0x43184a
push 0
push ebx
call fcn.00432970
add esp, 8
test eax, eax
jne 0x4316d9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x61c
ret
mov dx, word [0x514ff0]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], dx
mov word [esp + 0x21c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21e]
push 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x5f18c4]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x224]
push eax
push ecx
call fcn.00432980
add esp, 0x10
lea edx, [esp + 0x21c]
lea eax, [esp + 0x424]
push str.Extensions
push edx
push 0x4f7858
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x438]
push ecx
call fcn.00433230
add esp, 0x18
test eax, eax
je 0x43184a
push ebp
call fcn.00421f10
mov ecx, eax
call fcn.00423020
mov esi, eax
test esi, esi
je 0x431810
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
push 0x103
push edx
mov ecx, esi
stosw word es:[edi], ax
call fcn.0042a180
cmp word [esp + 0x14], 0
je 0x4317dc
mov eax, dword [esp + 0x63c]
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jl 0x4317dc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x61c
ret
mov esi, dword [esi + 0xd4]
test esi, esi
je 0x4317e8
call esi
mov eax, dword [esp + 0x640]
test eax, eax
je 0x43184a
mov ecx, dword [esp + 0x63c]
push ecx
push ebx
push ebp
call fcn.00431390
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x61c
ret
push ebp
push ebx
call fcn.00421f10
mov ecx, eax
call fcn.0042b670
mov esi, eax
test esi, esi
je 0x431860
mov edx, dword [esp + 0x630]
push 0
push edx
call dword [sym.imp.USER32.dll_EndDialog]
push ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.00429580
mov eax, dword [esp + 0x10]
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
and eax, 2
pop ebx
add esp, 0x61c
ret
mov eax, dword [esp + 0x63c]
push eax
push ebx
push ebp
call fcn.00431390
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x61c
ret
Function at 0x431cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcb90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp word [edi + 4], bx
lea eax, [edi + 4]
mov dword [ebp - 0x18], edi
jne 0x431d34
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x504384
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [ebp - 0x1c], esi
jne 0x431d62
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, edi
call fcn.00432150
cmp eax, ebx
jne 0x431d8b
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x7f]
mov byte [ebp - 0x80], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 0x64
lea eax, [ebp - 0x80]
push 1
push eax
call edi
add esp, 0x10
cmp eax, 0x64
jae 0x431dd4
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 1
lea ecx, [ebp - 0x14]
push 4
push ecx
mov dword [ebp - 0x14], ebx
call edi
add esp, 0x10
cmp eax, 1
jae 0x431e07
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x14]
push esi
push eax
push 1
push ebx
call edi
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp eax, ecx
jae 0x431e3c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x18]
push ecx
push ebx
mov ecx, edi
call fcn.00432220
test eax, eax
push ebx
jne 0x431e6f
call fcn.004d9644
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004d9644
add esp, 4
mov ecx, edi
push esi
call fcn.00432290
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432150
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov dword [esp + 0x15], eax
push edi
mov dword [esp + 0x1d], eax
push ebp
push 1
lea ecx, [esp + 0x20]
mov word [esp + 0x29], ax
push 0xc
push ecx
mov byte [esp + 0x28], 0
mov byte [esp + 0x33], al
call ebx
add esp, 0x10
mov ecx, 0xc
mov edi, str.TW.3_TAIHANG
lea esi, [esp + 0x18]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4321a1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4321bb
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
xor edx, edx
push ebp
mov dword [esp + 0x15], edx
push 1
lea eax, [esp + 0x18]
mov word [esp + 0x1d], dx
push 7
push eax
mov byte [esp + 0x20], 0
mov byte [esp + 0x27], dl
call ebx
add esp, 0x10
mov ecx, 7
mov edi, str.3.0.0.1
lea esi, [esp + 0x10]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4321f7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x432211
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 4

Function at 0x432290
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov edx, dword [ecx + 0x210]
push edi
xor edi, edi
mov dword [esp + 8], ecx
cmp edx, edi
jne 0x4322aa
mov dword [esp + 4], edi
jmp 0x4322b9
mov eax, dword [ecx + 0x214]
sub eax, edx
sar eax, 2
mov dword [esp + 4], eax
cmp dword [esp + 4], edi
jle 0x432303
push ebx
push ebp
push esi
jmp 0x4322c8
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x210]
mov ebx, dword [eax + edi*4]
mov esi, dword [ebx + 0x18]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x20]
mov ebp, eax
push ecx
push 1
push esi
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x14
mov ecx, ebx
push esi
push ebp
call fcn.00431c30
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x4322c4
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 4

Function at 0x432890
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push ebx
test eax, eax
push edi
je 0x4328de
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4328de
mov ebx, dword [esp + 0x14]
test ebx, ebx
jbe 0x4328de
push esi
xor esi, esi
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x4328d8
mov ecx, ebx
mov esi, eax
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret
pop edi
xor eax, eax
pop ebx
ret
Function at 0x4328f0
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push ebp
test eax, eax
push edi
je 0x432945
mov edi, dword [esp + 0x10]
test edi, edi
je 0x432945
mov ebp, dword [esp + 0x14]
test ebp, ebp
jbe 0x432945
push ebx
xor ebx, ebx
push esi
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x24]
lea esi, [eax + ecx]
test esi, esi
je 0x43293e
mov ecx, ebp
push eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
ret
pop edi
xor eax, eax
pop ebp
ret
Function at 0x432dd0
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4dcbdb
push eax
mov eax, 0x271c
mov dword fs:[0], esp
call fcn.004d9670
mov eax, dword [0x4f6eb4]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x273c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
mov ecx, 0x9c4
xor eax, eax
lea edi, [esp + 0x1c]
cmp esi, ebx
mov dword [esp + 0x2734], ebx
rep stosd dword es:[edi], eax
je 0x432e28
push esi
call ebp
mov ebx, eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00416bf0
test eax, eax
je 0x432e5e
mov edi, dword [esp + 0x10]
lea eax, [ebx + ebx]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], ebx
mov edx, dword [esp + 0x10]
mov word [eax + edx], 0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push 1
mov dword [esp + 0x1c], 0x5c
call fcn.00415310
mov esi, dword [esp + 0x2740]
test esi, esi
jne 0x432e85
xor eax, eax
jmp 0x432e88
push esi
call ebp
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00415310
mov ecx, dword [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x432eed
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4f6100]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x432ee6
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x432ee6
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004d9644
add esp, 4
xor eax, eax
jmp 0x432f81
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
mov esi, eax
push 0x40
push edi
sub esi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jbe 0x432f46
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, 0x2710
push 0
jbe 0x432f38
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
push 0x2710
push edx
push edi
call ebx
sub esi, 0x2710
jne 0x432f12
jmp 0x432f46
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push esi
push ecx
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4f6100]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x432f7c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x432f7c
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004d9644
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x272c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2728
ret
Function at 0x433120
Capabilities:
Get file version info

Disassembly:
mov eax, 0x400c
call fcn.004d9670
push esi
push edi
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x4018]
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4331e9
cmp eax, 0x3fff
ja 0x4331e9
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4331e9
lea edx, [esp + 0x10]
lea eax, [esp + 8]
push edx
push eax
lea ecx, [esp + 0x1c]
push 0x4f7728
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4331e9
mov eax, dword [esp + 8]
xor edx, edx
mov esi, dword [esp + 0x4020]
mov edi, dword [esp + 0x401c]
mov dx, word [eax + 0xc]
mov ecx, dword [eax + 0xc]
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
shr ecx, 0x10
push ecx
push edx
shr eax, 0x10
push eax
push str._d._d._d._d
push esi
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x1c
mov word [edi + esi*2 - 2], 0
mov eax, 1
pop edi
pop esi
add esp, 0x400c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x400c
ret

Function at 0x433200
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x433226
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 1
je 0x433228
mov eax, esi
pop esi
ret

Function at 0x433c30
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [0x5e7978], eax
je 0x433d16
push 0x5e7960
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 4]
mov dword [esp + 4], esi
push eax
push esi
push esi
push 0x434550
push esi
push esi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
je 0x433c7c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, byte [0x5e7930]
mov al, 1
test al, cl
jne 0x433cb5
mov dl, cl
push 0x433d30
or dl, al
mov dword [0x5e7920], 0x4e2300
mov byte [0x5e7930], dl
mov dword [0x5e7928], esi
mov dword [0x5e792c], esi
call fcn.004d96d2
add esp, 4
mov ecx, 0x5e7920
mov dword [0x5e7928], 0x4f91b8
call fcn.004352b0
mov cl, byte [0x5e7930]
mov al, 2
test al, cl
jne 0x433d02
mov dl, cl
push 0x433d20
or dl, al
mov dword [0x5e7910], 0x4e2300
mov byte [0x5e7930], dl
mov dword [0x5e7918], esi
mov dword [0x5e791c], esi
call fcn.004d96d2
add esp, 4
mov ecx, 0x5e7910
mov dword [0x5e7918], 0x5044e8
call fcn.004352b0
pop esi
pop ecx
ret
Function at 0x434600
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e23e0
push 0x4d96e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [0x506898]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x4346bb
mov dword [ebp - 0x20], esi
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push 0x4e7f14
push eax
call dword [ecx]
test eax, eax
jne 0x4346bb
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x4346bb
mov dword [ebp - 0x24], esi
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push esi
push 0x514ff0
mov edx, dword [ebp + 8]
push edx
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x43467f
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push esi
mov edx, dword [ebp + 0x10]
push edx
push 0xc8
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x4346a7
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4346bb
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43830e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dcd5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 0x20]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov cl, byte [esp + 0x30]
xor ebx, ebx
push 0x1c
mov dword [esp + 0x18], esi
mov byte [esi + 0x14], al
mov byte [esi + 0x15], cl
mov byte [esi + 0x1c], bl
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x18], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
cmp dword [0x5e79d4], ebx
jne 0x438362
mov dword [0x5e79d4], edi
mov dword [edi], ebx
mov edx, dword [0x5e79d4]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x5e79d0]
inc ecx
mov dword [0x5e79d0], ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp ebp, ebx
je 0x438386
push ebp
call fcn.004d9644
add esp, 4
mov edi, dword [0x5e79d4]
push 0x1c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], edi
mov dword [eax + 0x18], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
add esp, 4
mov dword [eax + 8], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], ebx
push edi
mov dword [esi], 0x4e2504
call fcn.00489250
mov ecx, eax
call fcn.00489600
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc

Function at 0x4391a0
Capabilities:
Get keyboard layout

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp esi, 7
je 0x4391bf
cmp esi, 0x51
jne 0x4391d1
mov eax, dword [esp + 0x18]
mov dword [0x620094], eax
jmp 0x4391d1
mov ecx, dword [0x515040]
push 0
push 0
push ecx
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [0x515040], esi
jne 0x4391fc
push 0
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [0x620094]
cmp ecx, eax
je 0x4391fc
push 0
push ecx
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
pop edi
pop esi
ret