joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428563
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x80
mov ebx, eax
jg 0x428678
push 0x10
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.004f0e50
push dword [ebp + 0x10]
push edi
push edi
call dword [ebp + 0x18]
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
mov esi, eax
add esp, 0x18
sar esi, 3
cmp dword [ebp + 0x14], 0
je 0x4285d5
test esi, esi
jle 0x428617
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x20]
sub ebx, edi
sub edx, edi
sub eax, edi
mov ecx, edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
mov al, byte [ebx + ecx]
xor al, byte [ecx]
mov esi, dword [ebp - 4]
mov byte [edx + ecx], al
mov byte [esi + ecx], al
inc ecx
dec dword [ebp - 8]
jne 0x4285bf
jmp 0x428617
and dword [ebp - 4], 0
test esi, esi
jle 0x428617
lea eax, [ebp - 0x20]
mov edx, ebx
mov dword [ebp - 8], edi
sub dword [ebp - 8], eax
sub edx, eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20]
sub eax, ecx
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
lea ecx, [ebp + ecx - 0x20]
mov al, byte [edx + ecx]
mov bl, byte [ebx + ecx]
xor bl, al
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
mov byte [eax + ecx], bl
jl 0x4285f5
mov ebx, dword [ebp + 0xc]
and ebx, 0x80000007
jns 0x428627
dec ebx
or ebx, 0xfffffff8
inc ebx
mov eax, dword [ebp + 0xc]
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebx, ebx
mov dword [ebp - 0xc], ebx
lea eax, [ebp + eax - 0x30]
jne 0x42864c
push 0x10
push eax
push edi
call fcn.004f0e50
add esp, 0xc
jmp 0x428678
mov dword [ebp - 8], 8
xor esi, esi
sub dword [ebp - 8], ebx
jmp 0x42865d
mov ebx, dword [ebp - 0xc]
mov dl, byte [eax + esi + 1]
mov cl, byte [ebp - 8]
shr dl, cl
mov ecx, ebx
mov bl, byte [eax + esi]
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x42865a
pop esi
pop ebx
leave
ret

Function at 0x428862
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x50dd14
call fcn.0050c608
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00405adf
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4288ad
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040586f
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x42888e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x42888e
lea ecx, [ebp - 0x10]
call fcn.00428788
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x4288e4
xor esi, esi
jmp 0x428891
push eax
call fcn.00428862
test eax, eax
pop ecx
je 0x4288e0
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x42888e
call edi
cmp eax, ebx
jne 0x4288e0
jmp 0x42888e
Function at 0x428902
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x50de0e
call fcn.0050c608
sub esp, 0x68
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x70]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x18], ebx
call fcn.004eef80
xor eax, eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x55daac]
xor edi, edi
inc edi
add esp, 0xc
mov ecx, 0x55daac
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0x53dadc
call fcn.00406327
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
neg esi
push ebx
sbb esi, esi
push ebx
and esi, 0xa
mov word [ebp - 0x44], si
mov esi, dword [ebp - 0x14]
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x428997
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x28], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4289aa
push dword [ebp - 0x28]
call edi
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x24], ebx
je 0x4289b7
push dword [ebp - 0x24]
call edi
mov dword [ebp - 0x24], ebx
lea eax, [esi - 0x10]
call fcn.0040586f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4289fd
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x50ddfc
call fcn.0050c608
sub esp, 0x70
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov ebx, ecx
jne 0x428a1d
xor eax, eax
jmp 0x428b65
mov eax, dword [0x55daac]
mov ecx, 0x55daac
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push 0x53dadc
call fcn.00406327
add esp, 0xc
lea esi, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.00409139
test eax, eax
jne 0x428b49
push 0x40
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x7c], 0x44
call fcn.004eef80
and dword [ebp - 0x34], 0
xor eax, eax
add esp, 0xc
neg ebx
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
sbb ebx, ebx
and ebx, 5
stosd dword es:[edi], eax
mov word [ebp - 0x4c], bx
xor ebx, ebx
push str.userenv.dll
stosd dword es:[edi], eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x74], 0x53db04
mov dword [ebp - 0x24], 0x30
mov dword [ebp + 8], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x428af3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x1c]
mov esi, eax
call edi
cmp esi, ebx
mov dword [ebp - 0x18], eax
je 0x428af3
push ebx
push dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
call esi
test eax, eax
je 0x428af0
mov dword [ebp - 0x24], 0x430
jmp 0x428af3
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x24]
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x34], ebx
mov edi, eax
je 0x428b22
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], ebx
je 0x428b30
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], ebx
je 0x428b3b
push dword [ebp + 8]
call dword [ebp - 0x18]
cmp dword [ebp - 0x1c], ebx
je 0x428b49
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x14], 0
je 0x428b58
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.0040586f
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x428b74
Capabilities:
Check os version
Create process on windows

Disassembly:
mov eax, 0x50dce8
call fcn.0050c608
sub esp, 0x184
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
jne 0x428b95
xor eax, eax
jmp 0x428d48
mov eax, dword [0x55daac]
mov ecx, 0x55daac
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x53dadc
call fcn.00406327
push 0x110
lea eax, [ebp - 0x18c]
push ebx
push eax
call fcn.004eef80
add esp, 0x18
lea eax, [ebp - 0x190]
push eax
mov dword [ebp - 0x190], 0x114
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x428bfa
cmp dword [ebp - 0x18c], 6
jne 0x428bfa
inc esi
cmp esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x10]
jne 0x428c0e
call fcn.00409139
jmp 0x428c13
call fcn.004090e9
cmp eax, ebx
jne 0x428d2c
push 0x40
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], 0x44
call fcn.004eef80
push dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 5
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], ax
call fcn.004091a4
add esp, 0x10
test al, al
jne 0x428c78
cmp dword [ebp - 0x10], ebx
je 0x428c6e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0040931e
pop ecx
push str.userenv.dll
mov dword [ebp - 0x70], 0x53db04
mov dword [ebp - 0x14], 0x30
mov dword [ebp + 8], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x428cd7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x1c]
mov esi, eax
call edi
cmp esi, ebx
mov edi, eax
je 0x428cd7
push ebx
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call esi
test eax, eax
je 0x428cd4
mov dword [ebp - 0x14], 0x430
jmp 0x428cd7
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], eax
je 0x428d07
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], ebx
je 0x428d15
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x428d1e
push dword [ebp + 8]
call edi
cmp dword [ebp - 0x1c], ebx
je 0x428d2c
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x10], ebx
je 0x428d3a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040586f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x428e76
Capabilities:
Query environment variable

Disassembly:
push 0x14
push 0x54acf8
call fcn.0050c628
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], eax
je 0x428f24
cmp dword [ebp + 0xc], eax
je 0x428f24
push eax
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call edi
mov esi, eax
cmp esi, 1
jb 0x428f24
mov ebx, 0x103
cmp esi, ebx
ja 0x428f24
and dword [ebp - 4], 0
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ebbfb
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x428f20
lea ecx, [esi + esi]
push ecx
push 0
push eax
call fcn.004eef80
add esp, 0xc
push esi
push dword [ebp - 0x24]
push dword [ebp + 8]
call edi
test eax, eax
je 0x428f20
cmp eax, ebx
ja 0x428f20
push eax
push dword [ebp - 0x24]
push ebx
push dword [ebp + 0xc]
call fcn.004f27ae
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x428f20
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x428f33
push dword [ebp - 0x1c]
call fcn.004eef75
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.0050c663
ret

Function at 0x428f3c
Capabilities:
Create directory
Delete directory

Disassembly:
mov eax, 0x50e5f3
call fcn.0050c608
push ebx
push esi
push edi
and dword [ebp - 4], 0
push str._access
lea eax, [ebp + 8]
push eax
call fcn.00406098
mov ebx, dword [ebp + 8]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
test edi, edi
je 0x428f7e
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x428f85
call esi
cmp eax, 5
je 0x428f88
xor edi, edi
inc edi
lea eax, [ebx - 0x10]
call fcn.0040586f
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x429973
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x50fe1a
call fcn.0050c608
push esi
xor esi, esi
cmp dword [ebx], esi
push edi
je 0x429998
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 4
cmp dword [ebp + 8], esi
jne 0x4299f3
push 0x400000
lea ecx, [ebp + 8]
call fcn.00408d97
pop ecx
mov dword [ebp - 4], esi
lea esi, [ebx + 4]
mov edi, esi
call fcn.00404ed3
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040586f
push str.data_fileinfo.dat
push 0x104
call fcn.004059a0
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [esi]
test eax, eax
je 0x4299ea
push eax
call fcn.004ef8f4
pop ecx
mov edx, esi
call fcn.00405967
jmp 0x4299ff
push dword [ebp + 8]
lea esi, [ebx + 4]
push esi
call fcn.00405cfa
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x429a12
xor eax, eax
jmp 0x429988
mov eax, dword [0x55daac]
mov ecx, 0x55daac
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi]
push eax
call fcn.004298ff
test eax, eax
jne 0x429a48
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040586f
jmp 0x429a0b
lea edi, [ebx + 0x24]
lea eax, [ebp + 8]
call fcn.00429e3a
lea eax, [ebp + 8]
push eax
push ebx
call fcn.00429a93
test eax, eax
jne 0x429a75
xor esi, esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040586f
mov eax, esi
jmp 0x429988
mov ecx, ebx
call fcn.00429b2d
mov eax, ebx
call fcn.00429cbd
mov ecx, ebx
call fcn.00429d03
xor eax, eax
inc eax
mov dword [ebx], eax
mov esi, eax
jmp 0x429a63
Function at 0x429d03
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x50f42a
call fcn.0050c608
sub esp, 0x28
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x30]
push eax
mov esi, ecx
call fcn.0040496b
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.00404a32
test al, al
je 0x429e1f
mov edi, str.eid1
push edi
lea eax, [ebp - 0x30]
call fcn.00404e3f
test al, al
je 0x429db0
push edi
lea eax, [ebp - 0x30]
call fcn.00404e7a
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405adf
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0042932e
test eax, eax
je 0x429da1
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00405adf
lea eax, [ebp - 0x18]
push eax
lea eax, [esi + 8]
push eax
mov byte [ebp - 4], 2
call fcn.00429e7b
mov edi, eax
mov eax, ebx
call fcn.00404ed3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040586f
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040586f
mov edi, str.eid2
push edi
lea eax, [ebp - 0x30]
call fcn.00404e3f
test al, al
je 0x429e1f
push edi
lea eax, [ebp - 0x30]
call fcn.00404e7a
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405adf
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0042932e
test eax, eax
je 0x429e14
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00405adf
lea eax, [ebp - 0x18]
push eax
add esi, 8
push esi
mov byte [ebp - 4], 4
call fcn.00429e7b
mov edi, eax
mov eax, ebx
call fcn.00404ed3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040586f
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040586f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004049e7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42b090
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov eax, 0x50dd14
call fcn.0050c608
push ecx
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00405fe1
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
mov dword [esp], str.dataproduct.dat
push eax
call fcn.00406098
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b0e1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040586f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
push dword [ebp - 0x10]
push 0x64
push 0x53dbb4
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ecx], eax
inc esi
jmp 0x42b0c7
Function at 0x42badd
Capabilities:
Create thread

Disassembly:
mov eax, 0x510b84
call fcn.0050c608
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [edi], ebx
push esi
jne 0x42baf8
xor al, al
jmp 0x42bb7d
lea eax, [edi + 0x1c]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea esi, [edi + 0xc]
mov dword [ebp - 4], ebx
call fcn.00463b6b
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea esi, [edi + 8]
mov eax, esi
call fcn.0042a80f
test eax, eax
jne 0x42bb73
push 0xc
call fcn.00415102
cmp eax, ebx
pop ecx
jne 0x42bb40
mov dword [ebp + 8], ebx
jmp 0x42bb61
push ebx
push ebx
push eax
push 0x42be87
push ebx
push ebx
mov dword [eax], edi
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x42bb8d
call fcn.004f24c7
add esp, 0x18
mov dword [ebp + 8], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x42bb6e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [esi], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x42e31a
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov eax, 0x50f830
call fcn.0050c608
sub esp, 0x278
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x20]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call fcn.00405adf
push edi
push 2
mov dword [ebp - 4], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x1c], esi
jne 0x42e377
push 0xfffffffffffffffe
pop esi
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.0040586f
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push 0x228
lea eax, [ebp - 0x280]
push edi
push eax
call fcn.004eef80
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
push esi
mov dword [ebp - 0x284], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x42e3b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffd
jmp 0x42e358
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x54]
push eax
call fcn.00406de0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42e3d2
xor edi, edi
mov eax, dword [ebp - 0x27c]
cmp eax, dword [ebp - 0x24]
je 0x42e45c
cmp eax, edi
je 0x42e45c
cmp eax, 4
je 0x42e45c
push eax
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42e45c
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00406e4a
mov esi, dword [ebp + 8]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x42e44e
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx - 0xc]
cmp eax, ecx
jl 0x42e44e
push ecx
push esi
push edx
call fcn.004f0291
add esp, 0xc
test eax, eax
jne 0x42e44e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 1
je 0x42e448
push dword [ebp - 0x27c]
call fcn.004070cb
cmp eax, 1
pop ecx
jne 0x42e44b
inc dword [ebp - 0x14]
inc dword [ebp - 0x18]
push edi
call ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040586f
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42e3d0
push dword [ebp - 0x1c]
call ebx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42e484
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
lea esi, [ebp - 0x34]
call fcn.0040742b
lea esi, [ebp - 0x54]
call fcn.00406d06
mov esi, dword [ebp - 0x14]
jmp 0x42e359
Function at 0x42e5eb
Capabilities:
Check if file exists

Disassembly:
push ecx
mov eax, dword [esi + 8]
cmp dword [eax - 0xc], 0
jne 0x42e5fc
mov eax, 0x13a
pop ecx
ret
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42e60e
mov eax, 0x13b
pop ecx
ret
call fcn.00407d80
cmp eax, 0xd
jge 0x42e649
push dword [esi + 0x1c]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00428b74
add esp, 0xc
test eax, eax
je 0x42e633
xor eax, eax
pop ecx
ret
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
call fcn.004289fd
test eax, eax
pop ecx
pop ecx
jne 0x42e62f
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
call fcn.00428902
neg eax
sbb eax, eax
pop ecx
and eax, 0xfffffec7
pop ecx
add eax, 0x139
pop ecx
ret

Function at 0x42ef10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0xc], 0xffffffff
jne 0x42ef74
push ebx
push edi
lea ebx, [ebp - 4]
call fcn.0042f45d
push dword [eax]
xor ebx, ebx
push ebx
push 0x53e2e8
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.0040586f
cmp edi, ebx
je 0x42ef63
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.0042f061
test eax, eax
je 0x42ef63
cmp dword [ebp - 4], ebx
jne 0x42ef6c
call fcn.0042f560
test eax, eax
je 0x42ef6f
xor eax, eax
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov eax, dword [esi + 0xc]
pop esi
leave
ret
Function at 0x42f104
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x50ecf3
call fcn.0050c608
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
test eax, eax
je 0x42f12e
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x42f259
mov eax, dword [0x55daac]
mov ecx, 0x55daac
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ebx, [ebp - 0x1c]
call fcn.0042f45d
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.004059a0
push eax
push str.1.01.21.5
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040586f
cmp dword [ebp - 0x14], ebx
jne 0x42f191
xor eax, eax
jmp 0x42f19a
push dword [ebp - 0x14]
call fcn.004ef8f4
pop ecx
lea edx, [ebp - 0x14]
call fcn.00405967
mov esi, 0x53e2e4
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042959e
jmp 0x42f235
push eax
call fcn.004f2936
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x42f1d1
xor ecx, ecx
jmp 0x42f1d9
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x42f1f9
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x42f1f9
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x42f216
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x42f205
call fcn.004ee90e
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.004505e6
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040586f
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042959e
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x42f1bc
add eax, 0xfffffff0
call fcn.0040586f
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040586f
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42f422
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
jne 0x42f458
push ebx
lea ebx, [ebp - 4]
call fcn.0042f45d
push dword [eax]
push 2
push 0x53e2f8
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.0040586f
pop ebx
mov eax, dword [esi + 0x18]
leave
ret