joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42442d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
or dword [esi + 0x3c], 0xffffffff
push edi
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
lea eax, [esi + 0x1c]
push eax
call fcn.0042ecb2
mov edi, eax
cmp edi, ebx
jge 0x424459
push str.Failed_to_copy_file_name.
jmp 0x424547
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
jne 0x4244a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x424481
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42448c
mov edi, 0x80004005
push edi
push 0x97
push str.cabextract.cpp
call fcn.0042fdc3
push str.Failed_to_create_begin_operation_event.
jmp 0x424547
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x28], eax
cmp eax, ebx
jne 0x4244ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4244c8
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x4244d3
mov edi, 0x80004005
push edi
push 0x9a
push str.cabextract.cpp
call fcn.0042fdc3
push str.Failed_to_create_operation_complete_event.
jmp 0x424547
push ebx
push ebx
push esi
push 0x4241e7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x424537
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x424515
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x424520
mov edi, 0x80004005
push edi
push 0x9e
push str.cabextract.cpp
call fcn.0042fdc3
push str.Failed_to_create_extraction_thread.
jmp 0x424547
call fcn.00423b69
mov edi, eax
cmp edi, ebx
jge 0x42454f
push str.Failed_to_wait_for_operation_complete.
push edi
call fcn.0042d996
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x424807
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00416075
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x424842
push dword [ebp + 8]
push str.Failed_to_calculate_resume_path_from_working_path:__ls
push eax
call fcn.0042d996
add esp, 0xc
jmp 0x4248f6
mov eax, dword [ebp + 0xc]
push ebx
push 0x80
push 4
push ebx
push 4
push 0xc0000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4248a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x424879
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x424887
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd3
push str.downloadengine.cpp
call fcn.0042fdc3
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.Failed_to_create_resume_file:__ls
push dword [ebp - 4]
jmp 0x424835
push ebx
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [edi + esi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4248ff
add edi, dword [ebp - 8]
cmp dword [ebp - 8], ebx
je 0x4248d1
cmp edi, 8
jb 0x4248a8
cmp edi, 8
je 0x4248db
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
or dword [ebp + 8], 0xffffffff
mov dword [eax], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x4248f6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x424913
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x424921
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xda
push str.downloadengine.cpp
call fcn.0042fdc3
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.Failed_to_read_resume_file:__ls
push dword [ebp - 4]
call fcn.0042d996
add esp, 0xc
jmp 0x4248e7
Function at 0x42494a
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [esi + 4]
mov dword [ebp - 8], ebx
push dword [esi]
push dword [ebp + 0xc]
call fcn.0043302b
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x42497e
push str.Failed_to_seek_to_start_point_in_file.
push eax
call fcn.0042d996
pop ecx
pop ecx
jmp 0x424aeb
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x424a64
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x424aea
xor edi, edi
mov dword [ebp - 0xc], ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
sub eax, edi
push eax
mov eax, dword [ebp + 0x1c]
add eax, edi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424aa2
add edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], ebx
je 0x4249d8
cmp edi, eax
jb 0x4249aa
add dword [esi], edi
adc dword [esi + 4], ebx
cmp dword [ebp + 0x10], 0xffffffff
je 0x424a2c
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x10], ebx
call fcn.0043302b
cmp eax, ebx
jge 0x424a07
push str.Failed_to_seek_to_start_point_in_file.
push eax
call fcn.0042d996
pop ecx
pop ecx
jmp 0x424a2c
push ebx
lea eax, [ebp - 0x10]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [esi + edi*8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
je 0x424a2c
cmp edi, 8
jb 0x424a07
mov eax, dword [ebp + 0x24]
cmp eax, ebx
je 0x424a56
cmp dword [eax], ebx
je 0x424a56
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [esi + 4]
push dword [esi]
push eax
call fcn.004160a6
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x424add
cmp dword [ebp - 8], ebx
jne 0x42497f
jmp 0x424aea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x424a78
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x424a86
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1b0
push str.downloadengine.cpp
call fcn.0042fdc3
push str.Failed_while_reading_from_internet.
push dword [ebp - 4]
jmp 0x424ae3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x424ab6
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x424ac4
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1bc
push str.downloadengine.cpp
call fcn.0042fdc3
push str.Failed_to_write_data_from_internet.
jmp 0x424a9d
push str.UX_aborted_on_cache_progress.
push eax
call fcn.0042d996
pop ecx
pop ecx
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x20
Function at 0x424cc1
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 7
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
je 0x424cef
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x424cfc
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor esi, esi
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x14]
push dword [eax]
call fcn.00435725
mov edi, eax
cmp edi, ebx
jl 0x424e2b
mov ebx, dword [ebp + 0x24]
xor edx, edx
cmp ebx, edx
je 0x424d24
mov ecx, ebx
cmp word [ebx], dx
jne 0x424d27
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp + 0x20]
cmp edi, edx
je 0x424d35
mov eax, edi
cmp word [edi], dx
jne 0x424d38
mov eax, dword [ebp - 0x18]
push edx
push edx
xor edx, edx
cmp dword [ebp - 0x24], 1
setne dl
lea edx, [edx + edx + 1]
push edx
push ecx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
test esi, esi
je 0x424e3a
test edi, edi
je 0x424d9f
cmp word [edi], 0
je 0x424d9f
test ebx, ebx
je 0x424d9f
cmp word [ebx], 0
je 0x424d9f
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call ebx
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0x2b
push esi
call edi
test eax, eax
je 0x424d9f
push dword [ebp + 0x24]
call ebx
push eax
push dword [ebp + 0x24]
push 0x2c
push esi
call edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp + 0x18]
push esi
call fcn.004245e0
mov edi, eax
test edi, edi
js 0x424e75
push dword [ebp + 0x30]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00424af3
mov edi, eax
test edi, edi
js 0x424e81
cmp dword [ebp - 8], 0
jne 0x424cd9
mov eax, dword [ebp + 0x28]
mov dword [eax], esi
mov eax, dword [ebp + 0x2c]
xor esi, esi
and dword [ebp - 4], esi
mov ecx, ebx
mov dword [eax], ecx
lea eax, [ebp - 0x24]
push eax
call fcn.00435474
cmp dword [ebp - 4], 0
pop ebx
je 0x424e18
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
je 0x424e23
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret 0x2c
push str.Failed_to_break_URL_into_server_and_resource_parts.
push edi
call fcn.0042d996
pop ecx
pop ecx
jmp 0x424dff
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x424e4e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x424e59
mov edi, 0x80004005
push edi
push 0x216
push str.downloadengine.cpp
call fcn.0042fdc3
mov eax, dword [ebp + 0x14]
push dword [eax]
push str.Failed_to_connect_to_URL:__ls
jmp 0x424e8b
mov eax, dword [ebp + 0x14]
push dword [eax]
push str.Failed_to_open_internet_URL:__ls
jmp 0x424e8b
mov eax, dword [ebp + 0x14]
push dword [eax]
push str.Failed_to_send_request_to_URL:__ls
push edi
call fcn.0042d996
add esp, 0xc
jmp 0x424dff
Function at 0x425daa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4510d0]
jne 0x425db4
repz ret
jmp fcn.00427da4

Function at 0x429b1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4510d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004275b2
and dword [ebp - 0x14], 0
cmp dword [0x452cfc], 0
mov dword [ebp - 0x18], eax
jne 0x429bce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x429c76
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44c504
push ebx
call edi
test eax, eax
je 0x429c76
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x452cfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x452d00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x452d04], eax
call edi
push eax
call esi
mov dword [0x452d0c], eax
test eax, eax
je 0x429bce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x452d08], eax
mov eax, dword [0x452d08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x429c27
cmp dword [0x452d0c], ecx
je 0x429c27
push eax
call esi
push dword [0x452d0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x429c27
test ebx, ebx
je 0x429c27
call edi
test eax, eax
je 0x429c1e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x429c1e
test byte [ebp - 8], 1
jne 0x429c27
or dword [ebp + 0x10], 0x200000
jmp 0x429c5a
mov eax, dword [0x452d00]
cmp eax, dword [ebp - 0x18]
je 0x429c5a
push eax
call esi
test eax, eax
je 0x429c5a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x429c5a
mov eax, dword [0x452d04]
cmp eax, dword [ebp - 0x18]
je 0x429c5a
push eax
call esi
test eax, eax
je 0x429c5a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x452cfc]
call esi
test eax, eax
je 0x429c76
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x429c78
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425daa
leave
ret
Function at 0x42d00a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [0x451ef0], 0xffffffff
mov dword [ebp + 8], eax
jne 0x42d044
push ebx
push edi
push 0x452d98
call fcn.0042ef0c
mov ebx, eax
test ebx, ebx
js 0x42d09c
xor ebx, ebx
jmp 0x42d09c
test eax, eax
je 0x42d09c
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [0x451ef0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42d082
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42d07c
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x42d08c
add esi, dword [ebp - 4]
cmp esi, dword [ebp + 8]
jb 0x42d048
jmp 0x42d09c
push ebx
push 0x31b
push str.logutil.cpp
call fcn.0042fdc3
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x42d637
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4510d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [str.unknown]
mov eax, 0x104
push eax
mov dword [ebp - 0x424], eax
xor ebx, ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x418], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x208
test eax, eax
jne 0x42d69b
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00425d30
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043363e
test eax, eax
jns 0x42d6c5
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x42d6e9
lea eax, [ebp - 0x414]
mov byte [eax], bl
inc eax
dec esi
jne 0x42d6e3
push ebx
lea eax, [ebp - 0x418]
push eax
call fcn.004358c4
push dword [ebp - 0x418]
push str._Logging_started:__ls_
push 2
pop esi
push esi
call fcn.0042d5b2
mov eax, dword [ebp - 0x420]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x41c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp - 0x20c]
push eax
push str.Executable:__ls_v_d._d._d._d
push esi
call fcn.0042d5b2
lea eax, [ebp - 0x414]
push eax
push str.Computer__:__ls
push esi
call fcn.0042d5b2
mov eax, dword [0x451ef4]
add esp, 0x34
sub eax, ebx
je 0x42d782
dec eax
je 0x42d77a
dec eax
je 0x42d772
dec eax
je 0x42d76a
dec eax
jne 0x42d788
mov edi, dword [str.debug]
jmp 0x42d788
mov edi, dword [str.verbose]
jmp 0x42d788
mov edi, dword [str.standard]
jmp 0x42d788
mov edi, dword [str.warning]
jmp 0x42d788
mov edi, dword [str.none]
push edi
push str.____logging_level:__hs____
push esi
call fcn.0042d5b2
add esp, 0xc
cmp dword [ebp - 0x418], ebx
pop edi
pop esi
pop ebx
je 0x42d7ad
push dword [ebp - 0x418]
call fcn.0042dd7e
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00425daa
leave
ret
Function at 0x42dae0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00425d30
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
jne 0x42db14
mov eax, 0x4385b4
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push str.__ls___ls
push eax
call fcn.0042f202
mov edi, eax
add esp, 0x10
cmp edi, ebx
jl 0x42db94
mov ax, word [ebp + 0x10]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42db89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42db6c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42db77
mov edi, 0x80004005
push edi
push 0xa9
push str.procutil.cpp
call fcn.0042fdc3
jmp 0x42db94
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x42dba7
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x42dbb4
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x42dbc1
push dword [ebp - 4]
call fcn.0042dd7e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x42f906
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x42f9c9
cmp word [eax], bx
je 0x42f9c9
push ebx
push eax
lea eax, [ebp - 4]
push eax
call fcn.0042ecb2
mov esi, eax
cmp esi, ebx
jl 0x42fa4c
lea eax, [ebp - 4]
push eax
call fcn.0042f8b1
mov esi, eax
cmp esi, ebx
jl 0x42fa4c
mov ebx, dword [ebp + 0x14]
xor edi, edi
inc edi
cmp dword [ebp + 0x10], edi
jb 0x42fa40
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.0042f202
mov esi, eax
add esp, 0xc
test esi, esi
js 0x42fa4c
push dword [ebp - 8]
push dword [ebp - 4]
push str._s_s
push ebx
call fcn.0042f202
mov esi, eax
add esp, 0x10
test esi, esi
js 0x42fa4c
xor esi, esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42fa40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42fa21
inc edi
mov esi, 0x800700b7
cmp edi, dword [ebp + 0x10]
jbe 0x42f961
jmp 0x42fa4c
mov edi, 0x104
push edi
lea eax, [ebp - 4]
push eax
call fcn.0042dc6e
mov esi, eax
cmp esi, ebx
jl 0x42fa4c
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x42f952
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42fa04
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x42fa0f
mov esi, 0x80004005
push esi
push 0x2d2
push str.pathutil.cpp
call fcn.0042fdc3
jmp 0x42fa4c
cmp eax, 3
jne 0x42fa30
push esi
push dword [ebx]
call fcn.00433fbe
jmp 0x42fa3e
cmp eax, esi
jle 0x42fa3e
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x42fa4c
push ebx
call fcn.0042f8b1
mov esi, eax
cmp dword [ebp - 8], 0
je 0x42fa5a
push dword [ebp - 8]
call fcn.0042dd7e
cmp dword [ebp - 4], 0
je 0x42fa68
push dword [ebp - 4]
call fcn.0042dd7e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x42fea2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4510d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00425d30
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42ff38
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x42ff0f
push 1
push 0x44dc9c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0042fe57
mov edi, eax
test edi, edi
js 0x42ff57
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042fe1a
mov edi, eax
test edi, edi
js 0x42ff57
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
jne 0x42ff57
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42ff4c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x42ff57
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425daa
leave
ret 8
Function at 0x432ab5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
push edi
push str.kernel32.dll
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, esi
jne 0x432b36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x432af3
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, esi
jl 0x432b01
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x90
push str.xmlutil.cpp
call fcn.0042fdc3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
test eax, eax
je 0x432b22
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x432b2f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
leave
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.IsWow64Process
push edi
call esi
test eax, eax
je 0x432b8b
push str.Wow64DisableWow64FsRedirection
push edi
call esi
push str.Wow64EnableWow64FsRedirection
push edi
mov ebx, eax
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [ebp - 0x10], eax
call esi
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x432b77
cmp dword [ebp - 0x10], 0
je 0x432b77
test eax, eax
jne 0x432b7d
and dword [ebp - 0x10], 0
jmp 0x432b8b
lea eax, [ebp - 0x14]
push eax
call ebx
push 1
call dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x438c88
push 1
push 0
mov ebx, 0x452e50
push ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
test eax, eax
js 0x432c38
push 0x10
pop ecx
mov edi, 0x438c78
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x432bc4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x432be1
push 0x10
pop ecx
mov edi, 0x438c68
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x432bdd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x432beb
mov dword [0x452e6c], 1
cmp dword [ebp + 8], 0
je 0x432c1c
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00432836
mov dword [ebp - 4], eax
test eax, eax
js 0x432c38
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 0
push dword [ebp - 0xc]
push eax
call dword [ecx + 0x54]
mov dword [ebp - 4], eax
test eax, eax
js 0x432c38
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 8], 0
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x432c38
mov ecx, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
mov dword [eax], ecx
cmp dword [ebp - 0x10], 0
pop ebx
je 0x432b13
push dword [ebp - 0x14]
call dword [ebp - 0x18]
test eax, eax
jne 0x432b13
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]