joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a9f5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x40aa1e
invalid
mov eax, dword [ebp - 4]
jmp 0x40ab37
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x40aa3d
mov eax, dword [ebp - 4]
jmp 0x40ab37
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + ecx + 0x7c], 0
jne 0x40aa57
mov eax, dword [ebp - 4]
jmp 0x40ab37
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + ecx + 0x78], 0
jne 0x40aa71
mov eax, dword [ebp - 4]
jmp 0x40ab37
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x18], 0
jne 0x40aa97
mov eax, dword [ebp - 4]
jmp 0x40ab37
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0
jmp 0x40aacd
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x18]
sub ecx, 1
cmp dword [ebp - 8], ecx
jae 0x40ab34
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4]
add ecx, dword [ebp + 8]
push ecx
call fcn.00409885
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x40ab32
cmp dword [ebp + 0x10], 0
je 0x40ab1a
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0x40ab30
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp + 8]
mov dword [ebp - 4], edx
jmp 0x40ab34
jmp 0x40aac4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40ac55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x64], 0x61
mov byte [ebp - 0x63], 0x64
Function at 0x40ac6a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x62], 0x76
mov byte [ebp - 0x61], 0x61
mov byte [ebp - 0x60], 0x70
mov byte [ebp - 0x5f], 0x69
mov byte [ebp - 0x5e], 0x33
mov byte [ebp - 0x5d], 0x32
mov byte [ebp - 0x5c], 0x2e
mov byte [ebp - 0x5b], 0x64
mov byte [ebp - 0x5a], 0x6c
mov byte [ebp - 0x59], 0x6c
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x3c], 0x70
mov byte [ebp - 0x3b], 0x73
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x70
mov byte [ebp - 0x38], 0x69
mov byte [ebp - 0x37], 0x2e
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x6c
mov byte [ebp - 0x34], 0x6c
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x54], 0x6d
mov byte [ebp - 0x53], 0x73
mov byte [ebp - 0x52], 0x76
mov byte [ebp - 0x51], 0x63
mov byte [ebp - 0x50], 0x72
mov byte [ebp - 0x4f], 0x74
mov byte [ebp - 0x4e], 0x2e
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x4c], 0x6c
mov byte [ebp - 0x4b], 0x6c
mov byte [ebp - 0x4a], 0
mov byte [ebp - 0x30], 0x77
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x6e
mov byte [ebp - 0x2d], 0x68
mov byte [ebp - 0x2c], 0x74
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x70
mov byte [ebp - 0x29], 0
mov byte [ebp - 0x48], 0x75
mov byte [ebp - 0x47], 0x73
mov byte [ebp - 0x46], 0x65
mov byte [ebp - 0x45], 0x72
mov byte [ebp - 0x44], 0x33
mov byte [ebp - 0x43], 0x32
mov byte [ebp - 0x42], 0x2e
mov byte [ebp - 0x41], 0x64
mov byte [ebp - 0x40], 0x6c
mov byte [ebp - 0x3f], 0x6c
mov byte [ebp - 0x3e], 0
call fcn.0040abf5
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x4e3da0
mov dword [ebp - 4], eax
push 0x8fecd63f
call fcn.0040ab45
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
push 0xcef6e822
invalid
invalid
std
invalid
Function at 0x40e128
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 4
pop esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x18
push 0x403fa0
push 0x403ef0
mov edi, SysReAllocStringLen
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x40e16a
cmp dword [ebp - 4], eax
setne al
jmp 0x40e16d
push 2
pop eax
sub eax, ebx
je 0x40e1a8
sub eax, 1
je 0x40e1a6
sub eax, 1
jne 0x40e1a8
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x10
push 0x403fc0
push 0x403fd8
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x40e1a8
cmp dword [ebp - 4], ebx
setne bl
jmp 0x40e1a8
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411a3d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push 1
push ecx
mov ecx, 0x4044a0
call fcn.0042c4ce
cmp word [ebp - 0x210], 0
je 0x411ab5
lea eax, [ebp - 0x210]
push eax
push 0
push 2
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x411ab5
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_SetEvent]
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x411adf
push 4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 1
push eax
push 4
push 0x4044e4
push 0x404508
push SysReAllocStringLen
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042f1b0
mov esp, ebp
pop ebp
ret
Function at 0x4132c7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43086d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, edx
lea eax, [esp + 0xc]
xor edi, edi
push eax
push 0x20019
push ecx
mov edx, 0x404598
mov dword [esp + 0x18], edi
mov ecx, SysReAllocStringLen
call fcn.0040ad96
test eax, eax
jne 0x413361
lea eax, [esp + 0x14]
mov dword [esp + 0x10], edi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
push edi
push edi
push 0x40493c
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [esp + 0x10], edi
je 0x413361
xor eax, eax
inc eax
jmp 0x4133c4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], ax
mov dword [esp + 0x40], edi
cmp word [esi], 0x2a
je 0x4133b3
lea edx, [esp + 0x18]
mov ecx, esi
call fcn.004133e8
cmp dword [esp + 0x2c], 8
mov ecx, dword [esp + 0x18]
jae 0x413398
lea ecx, [esp + 0x18]
call fcn.00420488
test eax, eax
je 0x4133b3
push ecx
push ecx
mov edx, esi
call fcn.00413441
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x4133b6
xor esi, esi
inc esi
push edi
push 1
lea ecx, [esp + 0x20]
call fcn.0040a778
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0042f1b0
mov esp, ebp
pop ebp
ret 8
Function at 0x413441
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
xor ebx, ebx
lea ecx, [ebp - 0x624]
push ebx
push ecx
push eax
mov dword [ebp - 0x624], ebx
call dword [sym.imp.api_ms_win_appmodel_runtime_l1_1_1.dll_GetPackageFullName]
cmp eax, 0x7a
je 0x41365a
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push ebx
push eax
call sub.msvcrt.dll_memset
lea ecx, [ebp - 0x210]
mov dword [esp], 0x405d24
call fcn.0042bc0d
test eax, eax
js 0x41365a
push 0xffffffffffffffff
push 0x403874
mov edi, 0x104
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncat_s]
add esp, 0x10
cmp eax, 0x50
je 0x41365a
push 0xffffffffffffffff
push 0x403654
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncat_s]
add esp, 0x10
cmp eax, 0x50
je 0x41365a
call fcn.0042c70c
test eax, eax
jne 0x41365a
call fcn.004095dc
test eax, eax
je 0x41353b
call fcn.00409589
test eax, eax
jne 0x41365a
push 0xffffffffffffffff
push 0x4049b4
lea eax, [ebp - 0x418]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
cmp eax, 0x50
je 0x41365a
push 0xffffffffffffffff
push 0x4049c8
lea eax, [ebp - 0x418]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncat_s]
add esp, 0x10
cmp eax, 0x50
je 0x41365a
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x418]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncat_s]
add esp, 0x10
cmp eax, 0x50
je 0x41365a
xor eax, eax
push 0x206
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x4049dc
lea eax, [ebp - 0x620]
push edi
push eax
call fcn.00419392
add esp, 0x14
test eax, eax
js 0x41365a
push 0x40
lea eax, [ebp - 0x67c]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x634], ebx
add esp, 0xc
mov dword [ebp - 0x680], 0x44
lea edi, [ebp - 0x630]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x680]
push eax
push ebx
push ebx
push 0x4000020
push ebx
push ebx
push ebx
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x413656
push dword [ebp - 0x630]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [ebp - 0x634]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, esi
jmp 0x41365c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f1b0
mov esp, ebp
pop ebp
ret 8
Function at 0x413674
Capabilities:
Delete file

Disassembly:
push 0x214
mov eax, 0x4308a7
call fcn.0042f358
mov eax, ecx
mov dword [ebp - 0x21c], eax
test eax, eax
jne 0x413699
mov eax, 0x80004003
jmp 0x41377e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.00415b89
mov ebx, eax
test ebx, ebx
js 0x413765
push 0x54
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemAlloc]
mov dword [ebp - 0x220], eax
and dword [ebp - 4], 0
test eax, eax
je 0x4136ee
push ecx
mov ecx, eax
call fcn.00411ea2
mov edi, eax
jmp 0x4136f0
xor edi, edi
or dword [ebp - 4], 0xffffffff
test edi, edi
jne 0x4136ff
mov ebx, 0x8007000e
jmp 0x41374f
mov esi, dword [edi]
lea eax, [ebp - 0x218]
push 0
push 0
push 0
mov ecx, dword [esi + 0x10]
push eax
call dword [0x438374]
mov ecx, edi
call dword [esi + 0x10]
mov ebx, eax
test ebx, ebx
js 0x41374f
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x438374]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
xor edi, edi
call fcn.00419212
mov ebx, eax
test ebx, ebx
js 0x413765
xor ebx, ebx
test edi, edi
je 0x413765
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x438374]
mov ecx, edi
call esi
cmp word [ebp - 0x218], 0
je 0x41377c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
mov eax, ebx
call fcn.0042f2f8
ret

Function at 0x413789
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
add ecx, 0x10
push esi
push edi
cmp dword [ecx + 0x14], 8
jb 0x4137a8
mov ecx, dword [ecx]
xor edi, edi
push edi
push 0x80
push 3
push edi
push 7
push 0x40000000
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4137f4
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemTime]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFileTime]
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042f1b0
mov esp, ebp
pop ebp
ret
Function at 0x41db79
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x80004005
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41dc06
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x41dbf2
cmp word [edx], bx
je 0x41dbf2
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41dbc0
sub ecx, ebx
xor eax, eax
push eax
sar ecx, 1
lea eax, [ebp - 4]
push eax
lea ebx, [ecx + ecx]
push ebx
push edx
push edi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x41dbf2
mov eax, dword [ebp - 4]
sub eax, ebx
neg eax
sbb eax, eax
and esi, eax
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x41dc06
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42026f
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x420295
mov eax, 0x80004003
jmp 0x4203ad
push ebx
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x20c]
mov edx, 0x104
push esi
call fcn.0040ad6a
test eax, eax
js 0x4203ac
push 0x5c
pop eax
cmp word [ebp - 0x20c], ax
je 0x420312
cmp word [ebp - 0x20c], 0x61
jb 0x4202ef
cmp word [ebp - 0x20c], 0x7a
jbe 0x4202fe
mov eax, dword [ebp - 0x20c]
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x420308
cmp word [ebp - 0x20a], 0x3a
je 0x420312
mov eax, 0x80004005
jmp 0x4203ac
push edi
lea ecx, [ebp - 0x20c]
call fcn.0042c8c7
mov edi, eax
xor eax, eax
push ebx
mov word [edi], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateDirectoryW]
test eax, eax
jne 0x4203a9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 3
jne 0x4203a2
lea esi, [ebp - 0x206]
cmp word [ebp - 0x206], bx
je 0x4203a2
push 0x5c
pop ecx
cmp esi, edi
ja 0x4203a2
cmp word [esi], bx
je 0x420393
cmp word [esi], cx
je 0x42036a
add esi, 2
cmp word [esi], bx
jne 0x42035d
cmp word [esi], bx
je 0x420393
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateDirectoryW]
test eax, eax
je 0x42038a
mov eax, ebx
jmp 0x420390
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push 0x5c
pop ecx
mov word [esi], cx
add esi, 2
cmp word [esi], bx
jne 0x420354
test eax, eax
je 0x4203a9
mov eax, 0x80004005
jmp 0x4203ab
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042f1b0
mov esp, ebp
pop ebp
ret

Function at 0x4203c1
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x431bcc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
cmp word [edi], 0x2a
jne 0x42043f
push 0x20
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemAlloc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], esi
test eax, eax
je 0x42041b
push esi
push 1
push edi
mov ecx, eax
call fcn.004204f8
mov edi, eax
jmp 0x42041d
mov edi, esi
or dword [esp + 0x20], 0xffffffff
test edi, edi
je 0x42046f
mov ecx, edi
call fcn.00421054
mov ecx, edi
mov esi, eax
call fcn.00420737
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
jmp 0x42046f
xor edx, edx
push 3
inc edx
call fcn.004207c6
mov edi, eax
cmp edi, 0xffffffff
je 0x420463
push esi
push edi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x42046f
xor edx, edx
mov ecx, 0xe5643666
call fcn.0041d372
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42b5ee
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, 0x411
push esi
xor esi, esi
mov eax, esi
cmp dx, cx
jne 0x42b60c
mov eax, 0x405ad8
jmp 0x42b61b
mov edx, 0x804
cmp dx, cx
jne 0x42b61b
mov eax, 0x405b50
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 1
push ecx
lea ecx, [ebp - 4]
push ecx
push esi
push 0x2011f
push esi
push esi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x42b663
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x405ba4
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42bc0d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x224], eax
push edi
mov dword [ebp - 0x220], esi
mov edi, 0x20019
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
and dword [ebp - 0x21c], 0
mov ebx, eax
push 0x405c24
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0x42bc83
push 0x405c38
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x42bc7d
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
push ebx
call dword [0x438374]
call esi
mov esi, dword [ebp - 0x220]
cmp dword [ebp - 0x21c], 0
je 0x42bc91
mov edi, 0x20119
lea eax, [ebp - 0x218]
xor ebx, ebx
push eax
push edi
push ecx
mov edx, 0x405cc8
mov dword [ebp - 0x218], ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040ad96
test eax, eax
jne 0x42bd3a
mov edi, 0x206
mov word [ebp - 0x214], ax
push edi
lea eax, [ebp - 0x212]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x228], edi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push ebx
push dword [ebp - 0x224]
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x42bd3a
mov edi, 0x104
mov word [ebp - 0xe], ax
push edi
push esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x42bd3a
cmp eax, edi
jae 0x42bd3a
cmp dword [ebp - 0x218], ebx
je 0x42bd36
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
jmp 0x42bd53
cmp dword [ebp - 0x218], ebx
je 0x42bd4e
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 0x80004005
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f1b0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42c1e3
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x42c2f9
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, ebx
cmp dword [esi + 0x10], ebx
jne 0x42c236
call fcn.00409589
test eax, eax
je 0x42c239
xor edi, edi
inc edi
push edi
push 1
push 0x104
lea edx, [ebp - 0x20c]
mov ecx, 0x405e50
call fcn.0042c542
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], ebx
call fcn.0042be1d
test eax, eax
je 0x42c2c0
cmp dword [ebp - 0x210], ebx
je 0x42c2c0
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x1f0001
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_OpenMutexW]
mov dword [esi + 4], eax
test eax, eax
jne 0x42c2da
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 2
jne 0x42c2da
push edi
push ebx
push 0x104
lea edx, [ebp - 0x20c]
mov ecx, 0x405e50
call fcn.0042c542
xor ecx, ecx
jmp 0x42c2c3
mov ecx, dword [esi + 0x10]
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0042cb6d
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_CreateMutexW]
mov dword [esi + 4], eax
pop edi
push dword [ebp - 0x214]
cmp dword [esi + 4], ebx
jne 0x42c2f3
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x42c2fb
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f1b0
mov esp, ebp
pop ebp
ret

Function at 0x42c891
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebx
push edi
mov edi, ecx
xor ebx, ebx
test edi, edi
je 0x42c8bd
push esi
push 1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetErrorMode]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
cmp eax, 0xffffffff
push esi
setne bl
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetErrorMode]
pop esi
pop edi
mov eax, ebx
pop ebx
ret