joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420fe0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x4fb068]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.00499e80
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x421122
cmp dword [esi + 4], 6
push edi
ja 0x421036
jne 0x4210be
cmp dword [esi + 8], 2
jb 0x4210be
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x4210be
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4210be
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4210be
movups xmm0, xmmword [0x4dfbb4]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x4dfbc4]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4210be
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4210be
cmp word [edi + 2], ax
jbe 0x4210be
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x421109
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00499e80
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x421109
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.00496c8f
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.00496c8f
add esp, 0x140
ret
Function at 0x4221b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4eb2a0
push 0x49a400
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x4fb068]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040f215
mov ecx, edi
call fcn.004222d0
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x422243
test bl, bl
jne 0x4222b2
cmp edi, 0x1a
jne 0x4222b2
mov ecx, esi
call fcn.0040f215
push 0x410
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00499e80
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x430]
push eax
call fcn.004020d0
add esp, 4
push eax
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.00401ed0
mov ecx, esi
call fcn.00401dd0
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret

Function at 0x423ce0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x4fb068]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.00499e80
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x423d5e
cmp dword [esp + 0x14], 6
jb 0x423d5e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, 0x80000001
call fcn.00423b50
add esp, 0xc
test al, al
je 0x423d5e
cmp word [esi], 0
jne 0x423db6
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, 0x80000000
call fcn.00423b50
add esp, 0xc
test al, al
je 0x423d8a
cmp word [esi], 0
jne 0x423db6
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, 0x80000001
call fcn.00423b50
add esp, 0xc
test al, al
je 0x423dcb
cmp word [esi], 0
je 0x423dcb
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret
Function at 0x424310
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x283c]
mov eax, 0x283c
call fcn.00497cc0
push 0xffffffffffffffff
push 0x4bed78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp + 0x2838], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
xor ebx, ebx
lea eax, [ebp + 0x630]
push ebx
push eax
call fcn.00499e80
add esp, 0xc
mov eax, 0x22
mov word [ebp + 0x630], ax
test esi, esi
je 0x424511
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x424511
push esi
call edi
cmp eax, 0xffa
jge 0x424511
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x630]
push eax
call esi
push 0x4defd4
lea eax, [ebp + 0x630]
push eax
call esi
push 0x4df144
lea ecx, [ebp - 0x2c]
call fcn.00401e00
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.00426140
mov ecx, eax
call fcn.00426200
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401df0
test esi, esi
je 0x424511
push str.ShellExecuteW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x424511
lea ecx, [ebp]
call fcn.00423de0
xor edi, edi
lea esi, [ebp]
cmp word [esi], 0
je 0x424436
push 1
push 0
lea eax, [ebp + 0x630]
push eax
push esi
push str.open
push 0
call dword [ebp - 0x10]
cmp eax, 0x20
ja 0x424444
inc edi
add esi, 0x210
cmp edi, 3
jl 0x424415
jmp 0x424466
imul ebx, edi, 0x210
cmp dword [ebp + ebx + 0x208], 0
mov ebx, dword [ebp + ebx + 0x20c]
jne 0x42445e
add ebx, 0x10
test ebx, ebx
jne 0x42450d
mov edi, dword [ebp - 0x10]
lea eax, [ebp + 0x630]
push 1
push 0
push 0
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x424508
mov dword [ebp - 0x14], str._programfiles_x86__Internet_Exploreriexplore.exe
xor esi, esi
mov dword [ebp - 0x10], str._programfiles_Internet_Exploreriexplore.exe
nop dword [eax + eax]
push 0x208
lea eax, [ebp + 0x2630]
push 0
push eax
call fcn.00499e80
add esp, 0xc
lea eax, [ebp + 0x2630]
push 0x103
push eax
push dword [ebp + esi*4 - 0x14]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0x2630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4244fe
push 1
push 0
lea eax, [ebp + 0x630]
push eax
lea eax, [ebp + 0x2630]
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x424508
inc esi
cmp esi, 2
jb 0x4244a0
mov eax, ebx
jmp 0x424513
mov ebx, 0x10
mov eax, ebx
jmp 0x424513
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2838]
xor ecx, ebp
call fcn.00496c8f
lea esp, [ebp + 0x283c]
pop ebp
ret
Function at 0x4248c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4eb480
push 0x49a400
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4fb068]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x424929
xor eax, eax
jmp 0x424a9f
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424a6a
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x424a6a
push str.AllocateAndInitializeSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424a6a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x424a6a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424a6a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x424a6a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424a6a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x424a6a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424a6a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x424a6a
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x424a6a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x424a53
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x424a40
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x424a50
jmp 0x424a6a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.00424ac6
test ebx, ebx
jne 0x424a9d
test esi, esi
je 0x424a8f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x424a9d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4250a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x4250d7
xor al, al
jmp 0x42513a
and esi, 0xffffb1af
push esi
call fcn.00401de0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4250f2
mov al, 1
jmp 0x42513a
lea ecx, [ebp - 0x28]
call fcn.004077f0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004259f0
test al, al
je 0x425127
push esi
lea ecx, [ebp - 0x28]
call fcn.00401de0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x425127
mov bl, 1
jmp 0x425129
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret

Function at 0x425160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00401de0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4251de
lea ecx, [ebp - 0x28]
call fcn.004077f0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004259f0
test al, al
je 0x4251cd
lea ecx, [ebp - 0x28]
call fcn.00401de0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401df0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret
Function at 0x425410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bef30
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00401de0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x425456
mov al, 1
jmp 0x42554b
mov ecx, esi
call fcn.00401de0
push eax
lea ecx, [ebp - 0x28]
call fcn.00401e00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00425160
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401df0
cmp ebx, 0xffffffff
jne 0x425495
xor al, al
jmp 0x42554b
mov ecx, esi
call fcn.00401de0
push eax
lea ecx, [ebp - 0x28]
call fcn.00401e00
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.004250a0
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401df0
test bl, bl
je 0x42548e
mov ecx, esi
call fcn.00401de0
push eax
call edi
test eax, eax
jne 0x42544f
lea ecx, [ebp - 0x28]
call fcn.004077f0
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004259f0
test al, al
je 0x42550d
lea ecx, [ebp - 0x28]
call fcn.00401de0
push eax
call edi
test eax, eax
je 0x42550d
mov bl, 1
jmp 0x42553a
mov ecx, esi
call fcn.00401de0
push eax
lea ecx, [ebp - 0x44]
call fcn.00401e00
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.004250a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00401df0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret
Function at 0x425570
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x624
push 0xffffffffffffffff
push 0x4bef68
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp + 0x620], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x4fe128
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
call fcn.0040f6dc
mov dword [ebp - 4], 0
mov ecx, 0x4fe138
call fcn.00401dd0
test al, al
jne 0x42560e
mov ecx, 0x4fe138
call fcn.00401e50
cmp esi, eax
je 0x4255f8
call fcn.00401e50
mov edx, eax
cmp dword [eax + 0x14], 8
jb 0x4255ed
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
mov ecx, esi
call fcn.00401ed0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040f6ff
mov al, 1
jmp 0x4256cd
push 0x20c
lea eax, [ebp + 0x414]
push 0
push eax
call fcn.00499e80
add esp, 0xc
lea eax, [ebp + 0x414]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4256bc
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x61e], ax
lea eax, [ebp]
push eax
call fcn.00499e80
add esp, 0xc
lea eax, [ebp]
push 0x208
push eax
lea eax, [ebp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4256a0
test eax, eax
je 0x4256a0
add eax, eax
cmp eax, 0x412
jae 0x4256ee
xor ecx, ecx
mov word [ebp + eax], cx
lea eax, [ebp]
push eax
call fcn.004020d0
add esp, 4
push eax
lea eax, [ebp]
push eax
jmp 0x4255f1
lea eax, [ebp + 0x414]
push eax
call fcn.004020d0
add esp, 4
push eax
lea eax, [ebp + 0x414]
push eax
jmp 0x4255f1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040f6ff
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x620]
xor ecx, ebp
call fcn.00496c8f
lea esp, [ebp + 0x624]
pop ebp
ret
call fcn.004971c8
int3

Function at 0x425700
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4fb068]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.00499e80
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0
call fcn.00401de0
push eax
mov ecx, edi
call fcn.00401de0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x425795
xor eax, eax
mov word [esp + 0x216], ax
lea eax, [esp + 0xc]
push eax
call fcn.004020d0
add esp, 4
mov ecx, ebx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00401ed0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00496c8f
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00496c8f
add esp, 0x210
ret
Function at 0x429e70
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4fb068]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.00499e80
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x429f07
cmp dword [esp + 8], 6
jb 0x429f07
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.00496c8f
add esp, 0x118
ret

Function at 0x429f20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf830
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x4fb068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00401e00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00426140
mov ecx, eax
call fcn.00426200
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401df0
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00401e00
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00426140
mov ecx, eax
call fcn.00426200
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401df0
test ebx, ebx
je 0x42a035
test esi, esi
je 0x42a035
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c5c0
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x4bfcd0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [ebp + 4]
push eax
push 0x3fe
call edi
mov ebx, eax
test ebx, ebx
je 0x42c6a7
lea edx, [ebp + 4]
mov dword [ebp], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0
call fcn.00401e50
mov eax, dword [eax]
mov dword [ebp], eax
mov dword [ebp - 4], 0
cmp ebx, 0x3fe
jbe 0x42c6cc
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004974ed
add esp, 4
lea ecx, [ebp]
mov esi, eax
mov dword [ebp - 0x10], esi
call fcn.00412b20
mov dword [ebp], esi
test eax, eax
je 0x42c681
push eax
call fcn.00418224
push esi
push ebx
call edi
test eax, eax
je 0x42c698
cmp eax, ebx
ja 0x42c698
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov dword [edx + eax*2], ecx
jmp 0x42c6f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00418216
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.00496c8f
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x42c758
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x42c758
mov word [ebp + eax + 4], cx
xor eax, eax
xor esi, esi
test ebx, ebx
je 0x42c742
mov edi, 2
nop dword [eax]
cmp word [edx + edi - 2], 0
jne 0x42c73a
cmp eax, esi
je 0x42c73a
lea eax, [edx + eax*2]
push eax
lea ecx, [ebp - 0x30]
call fcn.00401e00
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.004075e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401df0
mov edx, dword [ebp - 0x10]
lea eax, [esi + 1]
inc esi
add edi, 2
cmp esi, ebx
jb 0x42c700
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00418216
mov al, 1
jmp 0x42c6a9
call fcn.004971c8
int3
Function at 0x4351b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x4fe478], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x4fe178], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x4fe378], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x4fe278], al
inc esi
cmp esi, 0x100
jl 0x4352c0
pop esi
add esp, 0x80
ret