joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push edi
mov eax, dword [0x45e274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
xor ebx, ebx
lea eax, [ebp - 0x5c]
push ebx
push eax
mov dword [ebp - 0x60], 0x3c
call fcn.00431630
add esp, 0xc
push esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, dword [0x45e020]
mov eax, dword [edx + 0xc]
mov ecx, 0x45e020
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push str._q__norestart
push ecx
mov dword [ebp - 4], ebx
call fcn.004032e0
mov edx, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
add esp, 8
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x4c], edi
mov dword [edx + 0x50], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x427610
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4275fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x28]
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x18]
push edx
push 1
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x4275d8
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
push ecx
push edx
mov dword [ebp - 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x427694
mov eax, dword [ebp - 0x10]
cmp eax, 0xbc2
jne 0x427659
call fcn.00423e50
mov eax, dword [ebp - 0x10]
jmp 0x42765d
test eax, eax
jne 0x427662
mov ebx, 1
mov ecx, dword [0x4615f8]
push ecx
push eax
push esi
push str.Prerequisite_install_path__retCode__RebootRequired_:__s___u___i
push 1
push 3
push 0xac
push str.CInstActionBase::PackageInstall
push str.InstActionBase.cpp
lea ecx, [ebp - 0x24]
call fcn.0042d570
push eax
call fcn.0042d790
add esp, 0x1c
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4276c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x427800
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esi + 0x24], 1
test eax, eax
je 0x42783c
push 0xffffffffffffffff
push eax
call edi
mov eax, dword [esi + 0x28]
test eax, eax
je 0x42783c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x28], 0
mov ecx, dword [esi + 0x1c]
push 0xffffffffffffffff
push ecx
call edi
mov edx, dword [esi + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
ret
Function at 0x427860
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b878
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x45e274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x4c]
test eax, eax
jne 0x427a20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0xc], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
call edx
add eax, 0x10
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00403300
mov eax, dword [edi + 0x48]
lea ecx, [ebp - 0x38]
push ecx
push eax
call fcn.0041c780
mov edx, dword [edi]
mov eax, dword [edx + 0x38]
add esp, 8
mov ecx, edi
call eax
test eax, eax
je 0x42791b
mov edi, dword [edi + 0x4c]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427914
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
jmp 0x427a20
mov ebx, dword [ebp - 0x38]
mov eax, dword [edi + 0x48]
push 0
push ebx
lea esi, [edi + 0x20]
call fcn.0041b350
mov esi, eax
test esi, esi
je 0x427966
cmp esi, 1
je 0x427957
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
call fcn.00420430
cmp dword [edi + 4], 0
je 0x427952
mov esi, 0x2710
jmp 0x427954
neg esi
mov dword [edi + 0x4c], esi
mov edi, dword [edi + 0x4c]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
jmp 0x4278fb
mov edx, dword [edi]
mov eax, dword [edx + 0x38]
mov ecx, edi
call eax
test eax, eax
je 0x42798c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [edi + 0x4c]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
jmp 0x4278fb
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov eax, dword [edi + 0x60]
lea ecx, [ebp - 0x34]
push ecx
push 0
push eax
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4279b6
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esi, dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0xc]
lea ecx, [ebp - 0x48]
push eax
push esi
push str.Presequisite__s_DOWNLOADED__time_spent:__u__size:__u
push 1
push 3
push 0x129
push str.CInstActionBase::Download
push str.InstActionBase.cpp
call fcn.0042d570
push eax
call fcn.0042d790
lea eax, [ebx - 0x10]
add esp, 0x1c
mov dword [edi + 0x4c], 0x2710
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427a1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x2710
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f0df
mov esp, ebp
pop ebp
ret
Function at 0x427be0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi + 0x4c], 0x2710
jne 0x427c1a
cmp dword [esi + 0x1c], 0
jne 0x427c1a
push 0
push 0
push esi
push 0x427a60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov eax, 1
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x429b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov dword [ebp - 4], 0
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x429d4e
lea ebx, [ebx]
cmp dword [esi + 0x6af90], 3
jb 0x429bb7
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x429bf7
mov edx, dword [esi + 0x6af84]
sub edx, ecx
cmp edx, 0x7efa
ja 0x429bf7
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x429be2
mov dword [esi + 0x6afa0], eax
mov eax, ecx
call fcn.00429850
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
jbe 0x429bf7
mov ebx, eax
mov eax, dword [esi + 0x6af84]
mov ecx, esi
cmp ebx, 3
jb 0x429cdb
sub eax, dword [esi + 0x6af88]
lea edx, [ebx - 3]
call fcn.00429000
sub dword [esi + 0x6af90], ebx
mov ecx, dword [esi + 0x6af90]
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x429ca4
cmp ecx, 3
jb 0x429ca4
mov edi, 1
sub ebx, edi
lea esp, [esp]
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub ebx, edi
mov dword [esi + edx*4 + 0x2af70], ecx
mov edx, dword [esi + 0x6af84]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + ecx*4 + 0x4af70], edx
jne 0x429c40
add dword [esi + 0x6af84], edi
mov eax, dword [ebp - 8]
jmp 0x429cf6
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, 0x7fff
mov dword [esi + 0x6af7c], edx
jmp 0x429cf6
movzx edx, byte [eax + esi + 0x1af70]
xor eax, eax
call fcn.00429000
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x429d30
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x429d0d
lea ecx, [eax + esi + 0x1af70]
jmp 0x429d0f
xor ecx, ecx
mov edi, dword [esi + 0x6af84]
push 0
sub edi, eax
push ecx
mov eax, esi
call fcn.00428e40
mov ecx, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], ecx
cmp dword [esi + 0x6af90], 0x106
jae 0x429d41
call fcn.004299f0
cmp dword [esi + 0x6af90], 0
jne 0x429b60
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x429d61
lea ecx, [eax + esi + 0x1af70]
jmp 0x429d63
xor ecx, ecx
mov edi, dword [esi + 0x6af84]
push 1
sub edi, eax
push ecx
mov eax, esi
call fcn.00428e40
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a950
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x42a957
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x42aa2d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
add ecx, 8
sub edx, 8
dec esi
jne 0x42a970
pop edi
test edx, edx
je 0x42aa4a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x450b18]
inc ecx
dec edx
jne 0x42aa31
not eax
pop esi
ret
Function at 0x42af00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
je 0x42afcc
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
push ebx
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
cmp eax, ecx
jb 0x42afab
add ecx, ecx
cmp ecx, eax
jbe 0x42af30
mov edi, ecx
mov dword [ebp - 4], edi
jmp 0x42af35
mov dword [ebp - 4], eax
mov edi, eax
push 0
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x42af6a
push edi
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x42af77
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 0x300
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
push ecx
push edx
push edi
call fcn.00432940
mov eax, dword [esi + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [esi + 0x18], edi
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x20], edx
mov dword [esi + 4], ebx
mov ecx, dword [esi + 0x1c]
mov eax, dword [ebp + 8]
add ecx, dword [esi + 0x18]
push edi
push eax
push ecx
call fcn.00432940
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x42aff7
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x42b280
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x58]
push edi
test ecx, ecx
je 0x42b2c7
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x42b304
sub edi, eax
cmp edi, edx
jbe 0x42b29e
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.00432940
mov eax, dword [esi + 0x4c]
add dword [esi + 0x60], edi
add dword [esi + 0x48], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0042a950
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x50]
test eax, eax
je 0x42b2fd
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b304
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x4c]
add dword [esi + 0x48], edi
mov edx, edi
mov ecx, ebx
call fcn.0042a950
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42b450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
push edi
mov dword [ebp - 4], 0
lea ebx, [esi + 0x68]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x42b497
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x42b4ea
sub edi, eax
cmp edi, 0x4000
jbe 0x42b485
mov edi, 0x4000
push edi
add eax, ecx
push eax
push ebx
call fcn.00432940
add esp, 0xc
add dword [esi + 0x60], edi
jmp 0x42b4b8
mov eax, dword [esi + 0x50]
test eax, eax
je 0x42b4e3
push 0
lea ecx, [ebp - 8]
push ecx
push 0x4000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b4ea
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0x4c]
add dword [esi + 0x48], edi
mov edx, edi
mov ecx, ebx
call fcn.0042a950
mov dword [esi + 0x4c], eax
test edi, edi
je 0x42b4ea
cmp edi, 0xffffffff
je 0x42b4ea
push edi
push ebx
call fcn.0042af00
cmp eax, edi
jne 0x42b4f9
add dword [ebp - 4], edi
jmp 0x42b465
mov dword [esi + 0xc], 0x1000000
mov edx, dword [ebp - 4]
pop edi
mov dword [esi + 0x64], edx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x60000
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42d7c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x44], 0xffffffff
mov dword [ebp - 4], ecx
jne 0x42d7d8
mov eax, 0x80040101
mov esp, ebp
pop ebp
ret 8
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x42d846
cmp dword [ebp + 8], esi
je 0x42d846
push ebx
mov dword [ebp + 0xc], esi
cmp edi, esi
jbe 0x42d81e
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x42d7fb
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, edi
sub edx, esi
push edx
lea edx, [esi + eax]
mov eax, dword [ecx + 0x44]
push edx
push eax
call ebx
test eax, eax
je 0x42d829
add esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x42d7f8
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42d820
pop ebx
and eax, 0xffff
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42dbe0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448e67
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45e274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], 0x10400
call fcn.0042eac0
lea eax, [esi + 0x5c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push edi
mov dword [eax + 0x10], ecx
push eax
mov byte [ebp - 4], 4
mov dword [eax + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x42dcb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x42dcb0
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
jge 0x42dcb8
push eax
call fcn.00403700
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e040
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448ee0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x45e274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
mov dword [ebp - 4], 0
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0042de40
mov esi, dword [ebx + 0x34]
dec esi
mov edi, eax
test esi, esi
jle 0x42e115
lea ecx, [ebp - 0x14]
lea eax, [esi - 1]
push ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x18], eax
call fcn.0042dcd0
mov edi, eax
test edi, edi
js 0x42e10e
lea edx, [ebp - 0x10]
push edx
push esi
mov ecx, ebx
call fcn.0042dcd0
mov edi, eax
test edi, edi
js 0x42e10e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x42e10e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42e10e
cmp eax, 3
je 0x42e10e
test eax, eax
jle 0x42e10c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov esi, dword [ebp - 0x18]
test esi, esi
jg 0x42e0b0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e138
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e15e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448f70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x45e274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.0042ef30
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0042e040
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, esi
call fcn.0042dcd0
mov ebx, dword [ebp - 0x10]
mov edi, eax
test edi, edi
js 0x42e55a
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.0042e180
mov edi, eax
test edi, edi
js 0x42e55a
push 0
push 0x80000080
push 2
lea ecx, [ebp - 0x34]
call fcn.0042efa0
push eax
push 5
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x44], eax
cmp eax, 0xffffffff
je 0x42e55a
cmp dword [esi + 0x30], 0
jne 0x42e517
push 0
lea edx, [ebp - 0x14]
push edx
push 2
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0042ef50
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e546
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
and ecx, 0x80000000
cmp ecx, 0x80000000
je 0x42e580
test eax, eax
jle 0x42e57e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0042ef50
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e5af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42eb20
Capabilities:
Check os version
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x45e274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x118], 0x114
call fcn.00431630
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ebf6
cmp dword [ebp - 0x114], 5
push edi
jne 0x42eb83
cmp dword [ebp - 0x110], 1
mov edi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
je 0x42eb88
mov edi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 0x18
push edi
push 0
push esi
call ebx
test eax, eax
jne 0x42ebe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x42ebbe
push 8
push 0x18
push edi
push 0
push esi
call ebx
test eax, eax
jne 0x42ebe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], 0
test eax, eax
jle 0x42ebd2
and eax, 0xffff
or eax, 0x80070000
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f0df
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f0df
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42ebd4
mov ecx, dword [ebp - 4]
and eax, 0xffff
xor ecx, ebp
or eax, 0x80070000
pop esi
call fcn.0042f0df
mov esp, ebp
pop ebp
ret