joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420c30
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x440
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x3a]
push ecx
mov ebx, edx
mov word [esp + 0x3c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x242]
push eax
mov word [esp + 0x244], dx
call fcn.00591690
add esp, 0xc
push 0
lea ecx, [esp + 0x34]
push ecx
push esi
mov ecx, 0x603380
call fcn.00421700
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
test al, al
je 0x420d0c
lea eax, [esp + 0x30]
lea edx, [eax + 2]
jmp 0x420cb0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420cb0
sub eax, edx
sar eax, 1
je 0x420d0c
lea edx, [esp + 0x30]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x38]
xor ecx, ecx
push 0x5c
push edx
mov word [eax], cx
call fcn.00593545
lea edx, [esp + 0x40]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x24c]
push str._sUser_DataDefaultCookies
push eax
call edi
add esp, 0x1c
lea ecx, [esp + 0x238]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x420d7d
push reloc.WS2_32.dll_accept
lea esi, [esp + 0x34]
mov ecx, str.360se6
call fcn.0041cc50
test al, al
jne 0x420d3d
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, str.360se6
call fcn.0041cc50
test al, al
jne 0x420d3d
push str.find_360_cookie_path_by_regedit_path_failed.
jmp 0x420da6
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420d44
sub eax, edx
sar eax, 1
je 0x420da1
lea edx, [esp + 0x30]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x38]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x244]
push str._sUser_DataDefaultCookies
push eax
call edi
add esp, 0x14
lea esi, [esp + 0x238]
call fcn.0041d0d0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.00590c4b
add esp, 0x440
ret
push str.find_360_cookie_path_failed.
lea ecx, [esp + 0x14]
call fcn.004016d0
lea ecx, [esp + 0x10]
call fcn.00401750
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00590c4b
add esp, 0x440
ret
Function at 0x420de0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x440
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x3a]
push ecx
mov ebx, edx
mov word [esp + 0x3c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x242]
push eax
mov word [esp + 0x244], dx
call fcn.00591690
add esp, 0xc
push 0
lea ecx, [esp + 0x34]
push ecx
push esi
mov ecx, str.360
call fcn.00421700
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
test al, al
je 0x420ebc
lea eax, [esp + 0x30]
lea edx, [eax + 2]
jmp 0x420e60
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420e60
sub eax, edx
sar eax, 1
je 0x420ebc
lea edx, [esp + 0x30]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x38]
xor ecx, ecx
push 0x5c
push edx
mov word [eax], cx
call fcn.00593545
lea edx, [esp + 0x40]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x24c]
push str._sUser_DataDefaultCookies
push eax
call edi
add esp, 0x1c
lea ecx, [esp + 0x238]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x420f2d
push reloc.WS2_32.dll_accept
lea esi, [esp + 0x34]
mov ecx, 0x6033d0
call fcn.0041cc50
test al, al
jne 0x420eed
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, 0x6033d0
call fcn.0041cc50
test al, al
jne 0x420eed
push str.find_360_chrome_cookie_path_by_regedit_path_failed.
jmp 0x420f56
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420ef4
sub eax, edx
sar eax, 1
je 0x420f51
lea edx, [esp + 0x30]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x38]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x244]
push str._sUser_DataDefaultCookies
push eax
call edi
add esp, 0x14
lea esi, [esp + 0x238]
call fcn.0041d0d0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.00590c4b
add esp, 0x440
ret
push str.find_360_chrome_cookie_path_failed.
lea ecx, [esp + 0x14]
call fcn.004016d0
lea ecx, [esp + 0x10]
call fcn.00401750
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00590c4b
add esp, 0x440
ret
Function at 0x420f90
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x444
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x43c], eax
push ebx
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x3a]
push ecx
mov ebx, edx
mov word [esp + 0x3c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x242]
push eax
mov word [esp + 0x244], dx
call fcn.00591690
add esp, 0xc
push 1
lea ecx, [esp + 0x34]
push ecx
push esi
mov ecx, 0x6035cc
call fcn.00421700
test al, al
je 0x421088
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421005
sub eax, edx
sar eax, 1
je 0x421088
lea edx, [esp + 0x30]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x38]
xor ecx, ecx
push 0x5c
push edx
mov word [eax], cx
call fcn.00593545
lea edx, [esp + 0x40]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x24c]
push str._sUser_DataDefaultCookies
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea ecx, [esp + 0x238]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421088
lea esi, [esp + 0x238]
call fcn.0041d0d0
pop esi
pop ebx
mov ecx, dword [esp + 0x43c]
xor ecx, esp
call fcn.00590c4b
add esp, 0x444
ret
push str.find_world_browser_cookie_path_failed.
lea ecx, [esp + 0x14]
call fcn.004016d0
lea ecx, [esp + 0x10]
call fcn.00401750
mov ecx, dword [esp + 0x444]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00590c4b
add esp, 0x444
ret
Function at 0x4210c0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
sub esp, 0x878
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x874], eax
mov eax, dword [esp + 0x87c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x47a]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov word [esp + 0x47c], cx
call fcn.00591690
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push esi
lea eax, [esp + 0x480]
push str._sCookies
push eax
call edi
add esp, 0x18
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x474]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x421144
xor al, al
jmp 0x42122e
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ebx, [ebx]
cmp word [esp + 0x44], 0x2e
je 0x42120a
mov ax, word [esp + 0x46]
test ax, ax
je 0x42120a
cmp ax, 0x2e
jne 0x42117c
cmp word [esp + 0x48], 0
je 0x42120a
test byte [esp + 0x18], 0x10
jne 0x42120a
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x272]
push ecx
mov word [esp + 0x274], ax
call fcn.00591690
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x68e]
push eax
mov word [esp + 0x690], dx
call fcn.00591690
lea ecx, [esp + 0x5c]
push ecx
push esi
lea edx, [esp + 0x288]
push 0x6035f0
push edx
call edi
lea eax, [esp + 0x6c]
push eax
push esi
lea ecx, [esp + 0x6a8]
push str._s_s_journal
push ecx
call edi
add esp, 0x38
lea edx, [esp + 0x268]
push edx
call ebp
test eax, eax
je 0x42120a
lea eax, [esp + 0x268]
push eax
call ebp
test eax, eax
jne 0x421249
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x421150
mov esi, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
setne al
mov ecx, dword [esp + 0x884]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00590c4b
add esp, 0x878
ret 4
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x268]
mov ecx, eax
mov esi, 1
sub edx, ecx
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x421260
jmp 0x421222
Function at 0x421700
Capabilities:
Get common file path

Disassembly:
sub esp, 0x838
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x834], eax
mov eax, dword [esp + 0x840]
push ebx
push ebp
mov ebp, dword [esp + 0x844]
push esi
push edi
mov ebx, ecx
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x43a]
push edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], eax
mov word [esp + 0x43c], cx
call fcn.00591690
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x642]
push ecx
mov word [esp + 0x644], ax
call fcn.00591690
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 0
push 0x17
lea edx, [esp + 0x438]
push edx
push 0
call esi
test eax, eax
je 0x42186c
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x232]
push ecx
mov word [esp + 0x234], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x2a]
push eax
mov word [esp + 0x2c], dx
call fcn.00591690
lea edi, [esp + 0x43c]
add esp, 0xc
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4217d2
mov edx, dword [esp + 0x854]
mov ecx, dword [0x602b08]
push edx
lea eax, [esp + 0x63c]
push eax
mov dword [edi], ecx
push ebx
lea ecx, [esp + 0x43c]
push ecx
mov ecx, ebp
call fcn.00421280
test al, al
je 0x42186c
lea edi, [esp + 0x228]
lea ebx, [esp + 0x638]
call fcn.0041cd60
push 0x104
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421835
sub eax, edx
sar eax, 1
je 0x421868
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x421852
mov al, 1
jmp 0x421968
mov ebx, dword [esp + 0x1c]
push 0
push 2
lea edx, [esp + 0x438]
push edx
push 0
call esi
test eax, eax
je 0x421966
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x232]
push eax
mov word [esp + 0x234], dx
call fcn.00591690
lea edi, [esp + 0x43c]
add esp, 0xc
add edi, 0xfffffffe
jmp 0x4218d0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4218d0
mov edx, dword [esp + 0x854]
mov ecx, dword [0x602b08]
push edx
lea eax, [esp + 0x63c]
push eax
mov dword [edi], ecx
push ebx
lea ecx, [esp + 0x43c]
push ecx
mov ecx, ebp
call fcn.00421280
test al, al
je 0x421966
lea edi, [esp + 0x20]
lea ebx, [esp + 0x638]
call fcn.0041cd60
push 0x104
lea edx, [esp + 0x22c]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421933
sub eax, edx
sar eax, 1
je 0x421966
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x228]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x421953
mov al, 1
jmp 0x421968
xor al, al
mov ecx, dword [esp + 0x844]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00590c4b
add esp, 0x838
ret 0xc
Function at 0x423b50
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x238], eax
push esi
push 0x103
lea eax, [esp + 0x135]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x13c], 0
call fcn.00591690
add esp, 0xc
push 0x103
lea ecx, [esp + 0x2d]
push 0
push ecx
mov byte [esp + 0x34], 0
call fcn.00591690
add esp, 0xc
lea edx, [esp + 0x130]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423bd7
sub eax, edx
je 0x423bee
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.00403c60
mov ecx, esi
call fcn.00408810
test al, al
jne 0x423c2b
mov ecx, esi
call fcn.00403c80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x423c2b
call fcn.00422cf0
test al, al
jne 0x423c40
push str.Can_not_find_the_specified_browser_cookies_path.
lea ecx, [esp + 0xc]
call fcn.004016d0
lea ecx, [esp + 8]
call fcn.00401750
xor al, al
pop esi
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret
push esi
call fcn.00423280
test al, al
je 0x423c2b
push esi
call fcn.00423350
test al, al
je 0x423c2b
push esi
call fcn.004239d0
mov ecx, dword [esp + 0x23c]
test al, al
setne al
pop esi
xor ecx, esp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret

Function at 0x425690
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5cdeba
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [edi + 4], 0x603b4c
mov dword [edi + 0xdc], vtable.CefBase.0
mov dword [esp + 0x20], eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x3c]
mov dword [edi], vtable.CefTask.0
mov ecx, dword [eax + 4]
mov dword [ecx + edi + 4], vtable.CefTask.1.0
mov edx, dword [edi + 4]
mov dword [edi], 0x603b34
mov eax, dword [edx + 4]
mov dword [eax + edi + 4], 0x603b3c
mov ecx, dword [edi + 4]
mov eax, dword [ecx + 4]
lea edx, [eax - 0xd8]
mov dword [eax + edi], edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [edi + 0x10], ecx
mov dword [edi + 8], eax
mov eax, dword [esp + 0x38]
lea ebp, [edi + 0x1c]
mov dword [edi + 0x14], edx
push esi
mov ecx, ebp
mov dword [esp + 0x18], 1
mov dword [edi + 0x18], eax
call fcn.00425980
lea ebx, [esi + 0xc]
lea esi, [ebp + 0xc]
call fcn.004259d0
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx + 0xb0]
mov dword [ebp + 0xb0], edx
mov dword [esp + 0x20], 1
mov dword [edi + 0xd4], 0
mov eax, dword [edi + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x18
Function at 0x4262e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x4262fd
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x14]
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x42632d
lea ebx, [ebx]
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x42632d
inc edi
cmp edi, ebx
jb 0x426320
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x426435
cmp eax, 3
jbe 0x426360
xor esi, esi
mov al, byte [edi + 4]
mov dword [esp + 0x10], ebp
test al, al
je 0x42639b
cmp al, 0xff
je 0x42639b
and esi, 3
add esi, esi
or esi, 1
inc ebp
jmp 0x426313
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x426346
movzx ecx, byte [esi + 0x600384]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x60037c], 0
mov al, byte [eax + 4]
je 0x426389
test al, al
je 0x426389
cmp al, 0xff
jne 0x426346
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
inc ebp
jmp 0x426313
movzx ecx, byte [edi + 3]
movzx edx, al
movzx eax, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
lea esp, [esp]
sub edx, ebp
sub edx, 5
mov eax, edx
test esi, esi
je 0x426407
movzx edx, byte [esi + 0x600384]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x4263ec
cmp bl, 0xff
jne 0x426403
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x4263c0
mov ebx, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, eax
shr edx, 8
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 3], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x426313
pop edi
pop ebx
cmp eax, 3
jbe 0x42644c
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
lea ecx, [eax - 1]
mov eax, dword [esp + 0x18]
shl esi, cl
and esi, 7
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x426620
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x670240], ecx
inc edx
cmp edx, 0x100
jb 0x426623
cmp edx, 0x800
jae 0x4266f9
lea ecx, [ecx]
mov eax, dword [edx*4 + 0x66fe40]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x670240]
inc edx
mov dword [edx*4 + 0x67023c], eax
cmp edx, 0x800
jb 0x4266d0
mov dword [0x672240], 0x426720
call fcn.00426590
test eax, eax
jne 0x426716
mov dword [0x672240], 0x4267d0
pop ecx
ret
Function at 0x42ad00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xb4]
push ebx
push ebp
mov ebp, dword [esp + 0xc8]
push esi
push edi
xor ebx, ebx
mov edi, 1
mov esi, edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
cmp dword [eax + 0x14], edi
je 0x42ad47
mov eax, edi
jmp 0x42ae9d
mov eax, dword [eax + 0x10]
push ecx
movzx ecx, byte [eax]
push ecx
lea ecx, [esp + 0x30]
call fcn.00428f20
add esp, 8
cmp eax, ebx
jne 0x42ae9d
mov edx, dword [esp + 0xd4]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x78], edi
lea ecx, [ecx]
mov eax, 0x40000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
cmp dword [esp + 0xcc], ebx
ja 0x42addc
jb 0x42add1
cmp dword [esp + 0xc8], eax
jae 0x42addc
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push ebp
call eax
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x42ae89
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x4c]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0xd8]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
lea esi, [esp + 0x38]
call fcn.00429110
mov esi, eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x24], eax
add esp, 0x10
sub dword [esp + 0xc8], eax
sbb dword [esp + 0xcc], ebx
cmp esi, ebx
jne 0x42ae89
mov ecx, dword [esp + 0x50]
cmp dword [esp + 0x4c], ecx
je 0x42ae6e
cmp eax, ebx
jne 0x42ae58
cmp edi, dword [esp + 0x4c]
je 0x42ae6e
push eax
mov eax, dword [ebp + 4]
push ebp
call eax
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x42adb0
jmp 0x42ae89
cmp ecx, dword [esp + 0xd4]
jne 0x42ae84
cmp dword [esp + 0x14], ebx
jne 0x42ae84
cmp dword [esp + 0x20], 1
je 0x42ae89
mov esi, 1
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 4]
push ecx
push eax
call edx
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00590c4b
add esp, 0xb0
ret
Function at 0x42b690
Capabilities:
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x5ce448
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x18]
call fcn.00401840
mov ecx, dword [esp + 0x50]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x48], 0
call fcn.00401840
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 1
call fcn.00587180
mov esi, eax
test esi, esi
je 0x42b7e6
lea ecx, [esp + 0x10]
call fcn.00402eb0
test eax, eax
jl 0x42b7e6
lea ecx, [esp + 0x10]
call fcn.00587180
push esi
push eax
call fcn.00592a95
mov esi, eax
add esp, 8
test esi, esi
je 0x42b7e6
lea ecx, [esp + 0x10]
call fcn.00587180
sub esi, eax
sar esi, 1
js 0x42b7e6
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.00412640
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 2
call fcn.00587180
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0042bca0
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp + 0x18]
cmp ax, 9
je 0x42b775
cmp ax, 6
jne 0x42b7d6
mov eax, str.X86KZMount2.exe
lea edi, [esp + 0xc]
call fcn.0042bea0
test eax, eax
jge 0x42b7a7
mov eax, str.X86KuaiZipDrive.sys
call fcn.0042bea0
test eax, eax
jge 0x42b7a7
mov eax, str.X86KuaiZipShell.dll
lea edi, [esp + 0xc]
call fcn.0042bea0
test eax, eax
jl 0x42b7dd
lea ecx, [esp + 0xc]
call fcn.004124a0
lea ecx, [esp + 0x10]
call fcn.004124a0
lea ecx, [esp + 0x14]
call fcn.004124a0
xor al, al
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
ret
mov eax, 0x603be8
jmp 0x42b79a
lea ecx, [esp + 0xc]
call fcn.004124a0
lea ecx, [esp + 0x10]
call fcn.004124a0
lea ecx, [esp + 0x14]
call fcn.004124a0
mov al, 1
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
ret
Function at 0x42bee0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x244
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x240], eax
mov eax, dword [esp + 0x24c]
push ebx
push ebp
mov ebp, dword [esp + 0x250]
push esi
push edi
push 0
push 2
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x42bfa9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
lea ecx, [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x22c
call fcn.00591690
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42bfa2
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x42bf93
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x18]
je 0x42bf93
push eax
push 0
push 0x100401
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x42bf93
mov eax, dword [esp + 0x14]
lea ebx, [esp + 0x10]
call fcn.0042c330
lea ecx, [esp + 0x1c]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42bf59
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00590c4b
add esp, 0x244
ret