joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f4f6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x42f58e
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
push 4
push 0x1000
mov edx, dword [ebp - 8]
add edx, 0x100
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42f584
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [0x54b4c4]
cmp dword [ebp + 0xc], 0
je 0x42f575
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x42f590
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42f8d5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cx, word [eax + 6]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
xor eax, eax
mov ax, word [edx + 0x14]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0xc]
jae 0x42f920
mov eax, dword [ebp + 0xc]
jmp 0x42f9a5
mov dword [ebp - 0x14], 0
jmp 0x42f932
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jae 0x42f9a2
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x38]
push edx
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 8]
push edx
call fcn.0042f899
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0xc]
add edx, dword [ebp - 0x18]
cmp dword [ebp + 0xc], edx
jae 0x42f9a0
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
sub esi, dword [ecx + eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 0x14]
push eax
call fcn.0042f867
add esp, 8
add eax, esi
jmp 0x42f9a5
jmp 0x42f929
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42fe02
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
je 0x42fef5
push 0
push 0
push 3
push 0
push 3
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x40000000
add eax, 0x80000000
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x54e144]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x42fe48
xor eax, eax
jmp 0x42fef7
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x14], 0
jne 0x42fe65
cmp dword [ebp - 8], 0
jne 0x42fe76
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42fef7
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
and edx, 2
add edx, 2
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x42fead
xor eax, eax
jmp 0x42fef7
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
and edx, 2
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
jne 0x42fee2
xor eax, eax
jmp 0x42fef7
cmp dword [ebp + 0xc], 0
je 0x42fef0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
jmp 0x42fef7
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x430552
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x354], eax
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00409100
mov eax, dword [ebp - 0x354]
movsx ecx, byte [ebp + eax - 0x20d]
cmp ecx, 0x5c
je 0x4305dc
push 0x4de820
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00408000
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409100
push 0x4de824
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00408000
mov dword [ebp - 0x108], 1
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [0x54b4e8]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x4306a6
cmp dword [ebp - 0x108], 0
je 0x4306a6
mov edx, dword [ebp - 0x350]
and edx, 0x10
test edx, edx
jne 0x43068a
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409100
lea edx, [ebp - 0x324]
push edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00408000
lea ecx, [ebp - 0x104]
push ecx
call dword [0x54b4b8]
lea edx, [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [0x54b4b4]
mov dword [ebp - 0x108], eax
jmp 0x43062e
cmp dword [ebp - 0x210], 0xffffffff
je 0x4306bc
mov ecx, dword [ebp - 0x210]
push ecx
call dword [0x54b4c8]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4306ce
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x354], eax
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00409100
mov eax, dword [ebp - 0x354]
movsx ecx, byte [ebp + eax - 0x20d]
cmp ecx, 0x5c
je 0x430758
push 0x4de828
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00408000
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409100
push 0x4de82c
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00408000
mov dword [ebp - 0x108], 1
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [0x54b4e8]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x43089a
cmp dword [ebp - 0x108], 0
je 0x43089a
mov edx, dword [ebp - 0x350]
and edx, 0x10
test edx, edx
jne 0x430810
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409100
lea edx, [ebp - 0x324]
push edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00408000
lea ecx, [ebp - 0x104]
push ecx
call dword [0x54b4b8]
jmp 0x43087b
lea edx, [ebp - 0x20c]
push edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00409100
lea ecx, [ebp - 0x324]
push ecx
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00408000
push 0x4de830
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x43087b
push 0x4de834
lea ecx, [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x43087b
lea edx, [ebp - 0x104]
push edx
call fcn.004306ce
add esp, 4
lea eax, [ebp - 0x350]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call dword [0x54b4b4]
mov dword [ebp - 0x108], eax
jmp 0x4307aa
cmp dword [ebp - 0x210], 0xffffffff
je 0x4308b0
mov edx, dword [ebp - 0x210]
push edx
call dword [0x54b4c8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x430ada
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x500
push edi
mov byte [ebp - 0x10c], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x430b1a
xor eax, eax
jmp 0x430ca1
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x10c]
push eax
call fcn.00415440
lea ecx, [ebp - 0x10c]
push ecx
call dword [0x54b4f0]
cmp eax, 0xffffffff
jne 0x430b4b
mov eax, 1
jmp 0x430ca1
mov byte [ebp - 0x4f4], 0
mov ecx, 0xf9
xor eax, eax
lea edi, [ebp - 0x4f3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x4f8], 0xffffffff
push 0
push 0
push 3
push 0
push 3
push 0x12019f
lea edx, [ebp - 0x10c]
push edx
call dword [0x54e144]
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0xffffffff
jne 0x430ba0
xor eax, eax
jmp 0x430ca1
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x4fc]
push eax
push 0x3e8
lea ecx, [ebp - 0x4f4]
push ecx
mov edx, dword [ebp - 0x4f8]
push edx
call dword [0x54b4c4]
test eax, eax
jne 0x430bd2
jmp 0x430c91
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x4fc]
push edx
lea eax, [ebp - 0x4f4]
push eax
call fcn.00430a2f
add esp, 0x10
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0
jne 0x430c0b
mov dword [ebp - 4], 1
jmp 0x430c91
cmp dword [ebp + 0x18], 0
je 0x430c65
mov ecx, dword [ebp + 0x14]
shr ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x500]
push edx
call fcn.00416760
add esp, 0xc
push 0
push 0
push 0
mov eax, dword [ebp - 0x4f8]
push eax
call dword [0x54b4e4]
push 0
lea ecx, [ebp - 0x4fc]
push ecx
mov edx, dword [ebp - 0x4fc]
push edx
lea eax, [ebp - 0x4f4]
push eax
mov ecx, dword [ebp - 0x4f8]
push ecx
call dword [0x54b4d4]
test eax, eax
jne 0x430c65
jmp 0x430c91
mov edx, dword [ebp - 0x4f8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x18], 0
jne 0x430c85
lea eax, [ebp - 0x10c]
push eax
call dword [0x54b4b8]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
jmp 0x430ca1
mov edx, dword [ebp - 0x4f8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x431d28
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov dword [ebp - 4], 0
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00431b96
add esp, 8
test eax, eax
je 0x431d51
jmp 0x431d59
mov eax, dword [ebp - 4]
jmp 0x431e67
push str.rundll32
lea edx, [ebp - 0x414]
push edx
call fcn.004167c0
add esp, 8
test eax, eax
je 0x431e22
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x431da0
mov eax, dword [ebp - 4]
jmp 0x431e67
cmp dword [ebp - 0x418], 1
jl 0x431e13
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], 0
push 0x2c
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.00432da0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x431dec
mov edx, dword [ebp - 0x424]
mov word [edx], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4debe4
mov edx, dword [ebp - 0x420]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x431e13
mov eax, dword [ebp - 4]
jmp 0x431e67
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x431e46
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x431e46
mov eax, dword [ebp - 4]
jmp 0x431e67
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x431e64
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x432e24
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x432e4a
xor eax, eax
jmp 0x432f19
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x108], 0
je 0x432e69
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x108]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x108], eax
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x108], 0
jne 0x432e92
xor eax, eax
jmp 0x432f19
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x108]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x432f17
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0x4dee44
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x108]
push ecx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x432f17
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
shr eax, 0x10
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
and edx, 0xffff
and edx, 0xffff
push edx
push 0x4dee60
push 0x104
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
mov eax, 1
jmp 0x432f19
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x434833
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3bc
push edi
mov dword [ebp - 0x3bc], ecx
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
imul eax, eax, 0x18
mov ecx, dword [eax + 0x4def70]
push ecx
mov edx, dword [ebp - 0x3bc]
push edx
push 0x4e1968
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.00403f10
add esp, 0x14
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x434929
mov dword [ebp - 0x3b4], 1
lea edx, [ebp - 0x108]
push edx
call fcn.0044fae0
mov ecx, eax
call fcn.0044ff04
test eax, eax
je 0x4348c8
jmp 0x434927
lea eax, [ebp - 0x108]
push eax
call fcn.00431968
add esp, 4
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 1
jne 0x4348e8
jmp 0x434927
cmp dword [ebp + 0xc], 2
je 0x4348fd
cmp dword [ebp + 0xc], 1
jne 0x434927
cmp dword [ebp - 0x3b4], 7
jne 0x434927
lea ecx, [ebp - 0x108]
test ecx, ecx
je 0x434920
lea edx, [ebp - 0x108]
push edx
push 0x319
push str.No_sing_and_not_1__d_szNewPath:_s
call fcn.00401ab0
add esp, 0xc
mov dword [ebp - 4], 1
jmp 0x434953
lea eax, [ebp - 0x108]
test eax, eax
je 0x43494c
lea ecx, [ebp - 0x108]
push ecx
push 0x32b
push str.File_is_not_exist__d_szNewPath:_s
call fcn.00401ab0
add esp, 0xc
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jne 0x43495d
xor eax, eax
jmp 0x4349c4
mov dword [ebp - 0x248], 2
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x110], 0
lea edx, [ebp - 0x108]
push edx
push 0x104
lea eax, [ebp - 0x3b0]
push eax
call fcn.00415480
mov dword [ebp - 0x3b8], 0
lea ecx, [ebp - 0x3b8]
push ecx
lea edx, [ebp - 0x3b0]
push edx
mov ecx, 0x54e3c0
call fcn.00416eb0
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x434ab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x104
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x208], eax
push 0x104
mov edx, dword [ebp - 4]
add edx, 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20c], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x435f78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push edi
mov dword [ebp - 0x418], ecx
mov byte [ebp - 0x30c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x414], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
call fcn.0047e220
push eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call fcn.00409100
mov ecx, dword [ebp + 8]
call fcn.0047e220
push eax
mov ecx, dword [ebp - 0x418]
call fcn.0043611c
mov dword [ebp - 0x310], eax
push 0x104
lea ecx, [ebp - 0x30c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x208]
push eax
push 0x104
lea ecx, [ebp - 0x414]
push ecx
call fcn.00415480
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
cmp dword [ebp - 0x310], 0
je 0x4360d5
movsx eax, byte [ebp - 0x30c]
test eax, eax
je 0x4360d5
movsx ecx, byte [ebp - 0x104]
test ecx, ecx
je 0x4360d5
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsRootA]
test eax, eax
jne 0x4360c9
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4360c9
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4360d5
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 6
jmp 0x436115
cmp dword [ebp - 0x310], 0
je 0x436102
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
cmp dword [eax + 0x14], 3
je 0x4360f6
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
cmp dword [edx + 0x14], 2
jne 0x436102
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 6
jmp 0x436115
cmp dword [ebp - 0x310], 0
je 0x436115
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 5
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x438e98
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0xedb88320
mov dword [ebp - 0xc], 0
jmp 0x438eb7
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x100
jge 0x438f0e
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 8
jmp 0x438ed8
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jle 0x438eff
mov eax, dword [ebp - 8]
and eax, 1
test eax, eax
je 0x438ef5
mov ecx, dword [ebp - 8]
shr ecx, 1
xor ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
jmp 0x438efd
mov edx, dword [ebp - 8]
shr edx, 1
mov dword [ebp - 8], edx
jmp 0x438ecf
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x54fc90], ecx
jmp 0x438eae
mov esp, ebp
pop ebp
ret

Function at 0x4397a9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x28
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x439819
lea edx, [ebp - 0x14]
push edx
push 0x4e1f14
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x43980f
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x439950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push 0x4e1f38
push 0xcd
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x439981
xor eax, eax
jmp 0x439a7c
mov eax, dword [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x4399b0
mov dword [ebp - 0x110], 0
xor eax, eax
jmp 0x439a7c
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x114], eax
mov edx, dword [ebp - 0x110]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 8]
push eax
push str._s_antiRK.dll
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.0040a230
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea edx, [ebp - 0x104]
push edx
call dword [0x54b4dc]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x439a27
xor eax, eax
jmp 0x439a7c
push 0
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [0x54b4d4]
test eax, eax
jne 0x439a60
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x439a7c
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x11c], 0xffffffff
mov eax, 1
mov esp, ebp
pop ebp
ret