joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
test byte [0x100563b0], 8
jne 0x10023080
mov ecx, dword [0x1007d010]
test ecx, ecx
je 0x100230ae
mov eax, dword [0x1007d00c]
leave
ret
mov dword [esp + 0xc], 0x1005eb6b
mov dword [esp + 8], str.IsInternetESCEnabledLocal
mov dword [esp + 4], 0x100563b0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_14
mov ecx, dword [0x1007d010]
test ecx, ecx
jne 0x10023079
lea eax, [ebp - 4]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMap
mov dword [esp], ParseURLW
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x100230f8
mov eax, dword [0x1007d00c]
mov dword [0x1007d010], 1
leave
ret
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
mov dword [esp + 0x14], eax
lea eax, [ebp - 8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [esp + 8], 0
mov dword [esp + 4], str.IEHarden
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x10023142
cmp dword [ebp - 0x10], 4
je 0x10023158
mov dword [0x1007d00c], eax
mov eax, dword [ebp - 4]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x100230e1
mov edx, dword [ebp - 8]
xor eax, eax
test edx, edx
setne al
jmp 0x1002313d

Function at 0x10023170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
lea edx, [ebp - 8]
sub esp, 0x24
mov dword [ebp - 0x10], 4
mov dword [esp + 8], edx
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x100231b0
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 8]
mov dword [esp + 8], 0
mov dword [esp + 4], str.UrlEncoding
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
mov eax, dword [ebp - 8]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
sub esp, 4
test ebx, ebx
mov ebx, dword [ebp - 4]
leave
sete al
ret
Function at 0x1002b2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test byte [0x10056490], 8
jne 0x1002b368
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x1002b698
test esi, esi
je 0x1002b77a
cmp edi, 0xe
jbe 0x1002b350
cmp edi, 0x12
jne 0x1002b658
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.oleaut32.dll_SysAllocStringLen]
mov dword [esi], eax
sub esp, 8
test eax, eax
je 0x1002b3f7
mov edx, 1
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x1002b726
jmp dword [edi*4 + 0x10060854]
mov eax, dword [ebx + 0x18]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__s_____d__p__lx__n
mov dword [esp + 8], str.Uri_GetPropertyBSTR
mov dword [esp + 4], 0x10056490
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_18
jmp 0x1002b2fb
mov edx, 0x8007000e
jmp 0x1002b343
mov dword [esi], 0
mov edx, 0x80070057
jmp 0x1002b343
mov edx, 0x8000ffff
jmp 0x1002b343
mov edx, 0x80004001
test byte [0x10056490], 1
je 0x1002b343
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p_____d__p__lx__n
mov dword [esp + 8], str.Uri_GetPropertyBSTR
mov dword [esp + 4], 0x10056490
mov dword [esp], 0
mov dword [ebp - 0x10], edx
call sym._wine_dbg_log.constprop.0_18
mov edx, dword [ebp - 0x10]
jmp 0x1002b343
mov edx, 0x80004003
jmp 0x1002b343
Function at 0x1002f730
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov edi, dword [ecx + 8]
mov ebx, dword [ecx]
mov eax, dword [ecx + 4]
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edi
mov edi, dword [ecx + 0x10]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x20], edi
mov edi, dword [ecx + 0x18]
test byte [0x10056490], 8
jne 0x1002f7f8
test edi, edi
je 0x1002f8f0
cmp esi, 1
jbe 0x1002f7a0
cmp esi, 3
jne 0x1002f8f0
mov dword [edi], 0x1c
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
cmp esi, 3
je 0x1002f781
mov eax, dword [ebx - 4]
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
lea edx, [ebx - 4]
mov dword [esp], edx
call dword [eax + 0x1c]
sub esp, 8
test eax, eax
js 0x1002f789
mov edx, dword [ebx + 0x60]
mov eax, dword [ebp - 0x18]
test edx, edx
jne 0x1002f7dc
mov edx, dword [ebx + 0x28]
lea ecx, [edx - 1]
cmp ecx, 1
jbe 0x1002f7d9
cmp edx, 0xb
jne 0x1002f7dc
add eax, 0xc
add eax, 8
mov dword [edi], eax
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
test eax, eax
je 0x1002f8e0
mov ecx, eax
mov dword [ebp - 0x24], edx
shr ecx, 0x10
je 0x1002f8c8
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x100607e8
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_14
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x14], eax
lea eax, [ebx - 0xc]
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p_____s__p__lx__p__lx__p__n
mov dword [esp + 8], str.Marshal_GetMarshalSizeMax
mov dword [esp + 4], 0x10056490
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_18
jmp 0x1002f76b
movzx eax, ax
mov dword [esp], 0x100607d8
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_14
mov edx, dword [ebp - 0x24]
jmp 0x1002f873
mov eax, 0x10060718
jmp 0x1002f873
mov eax, 0x80070057
jmp 0x1002f789
Function at 0x1003a220
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
mov ebx, dword [0x10056540]
cmp ebx, 0xffffffff
je 0x1003a250
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x1003a290
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov edx, eax
cmp eax, 0xffffffff
je 0x1003a308
mov eax, ebx
lock cmpxchg dword [0x10056540], edx
mov ebx, eax
cmp dword [0x10056540], eax
je 0x1003a232
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsFree]
mov ebx, dword [0x10056540]
sub esp, 4
jmp 0x1003a232
mov dword [esp + 4], 0x10
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ebx, eax
test eax, eax
je 0x1003a244
mov dword [esp], 0x10056520
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [0x1005653c]
lea eax, [ebx + 8]
mov dword [ebx + 8], 0x10056538
sub esp, 4
mov dword [ebx + 0xc], edx
mov dword [edx], eax
mov dword [0x1005653c], eax
mov dword [esp], 0x10056520
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [0x10056540]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, ebx
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret
xor ebx, ebx
jmp 0x1003a244

Function at 0x10054a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10054a68
cmp byte [esi + ebx - 1], 0xa
je 0x10054a3c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1007d0c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10055090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10055268
mov edi, dword [0x1007d0c4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10055177
test byte [0x100565a4], 8
jne 0x10055210
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x100565b4], 8
jne 0x100551d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10055119
cmp esi, 3
jbe 0x10055188
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1005512a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1006beb0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10055119
mov dword [esp], 0x100565b4
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100550f0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100550f0
mov dword [esp], 0x100565a4
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100550db
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100550e3
mov eax, 0xffffffff
jmp 0x10055177
Function at 0x10055500
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x1007d0e0]
test eax, eax
je 0x100555b8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10055540
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1005552c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x100555ed
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x1007d0e0], eax
sub esp, 8
test eax, eax
jne 0x1005551d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1005552e
Function at 0x10055600
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x10055790
mov eax, dword [esi]
test eax, eax
je 0x10055778
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1005579c
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10055768
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1005572c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x10055666
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10055792
Function at 0x404bb4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x786008], 0x8088405
inc edx
mov dword [ebx + 0x786008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404bd0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x786008], 0x8088405
inc edx
mov dword [ebx + 0x786008], edx
fld qword [ebx + 0x786790]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x41de58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41deb1
test eax, edx
je 0x41deb4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41de6f
movzx eax, word [eax]
sub eax, ecx
jmp 0x41de96
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41de97
add ecx, 4
js 0x41de87
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41de94
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41de96
xor eax, eax
ret
test eax, eax
je 0x41dec0
test edx, edx
jne 0x41de60
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x424f68
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42503e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040787c
lea eax, [ebp - 4]
call fcn.00407a58
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00408338
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x425028
mov eax, ebx
call fcn.004047a4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x425021
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00408338
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x42500b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x425050
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x42500b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425028
mov eax, dword [ebp - 0x10]
call fcn.004047c0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425045
lea eax, [ebp - 4]
call fcn.00407454
ret
Function at 0x426cfc
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
mov edx, esp
mov eax, dword [edi + 0x20]
call fcn.00426990
mov eax, dword [esp]
inc dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 1
seta bl
call fcn.0040d0a8
cmp eax, dword [edi + 0x24]
je 0x426d66
test bl, bl
jne 0x426d66
mov eax, edi
call fcn.00426b44
jmp 0x426d5a
lea eax, [edi + 0xc]
call fcn.0041db6c
mov esi, eax
cmp esi, 0xffff
jne 0x426d4c
mov eax, edi
call fcn.00426b38
push 0
call sub.KERNEL32.DLL_TlsSetValue
mov eax, edi
call fcn.00426b44
lea eax, [edi + 0xc]
call fcn.0041db7c
test eax, eax
jle 0x426d33
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42d4e0
Capabilities:
Delete directory
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
call fcn.0042d3b4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryW
call fcn.0042d3b4
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
inc eax
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x42d81c
Capabilities:
Delete directory
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov dword [ebp - 0x308], ecx
mov ebx, edx
mov dword [ebp - 0x304], eax
test byte [ebx + 1], 0x20
jne 0x42d846
mov eax, 0x80070057
call fcn.0042d3b4
movzx eax, word [ebx]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x42d9cd
test ah, 0x40
je 0x42d86c
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov dword [ebp - 0x314], eax
jmp 0x42d875
mov eax, dword [ebx + 8]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x42d8fa
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_ReadFile
call fcn.0042d3b4
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
call fcn.0042d3b4
mov eax, dword [ebp - 0x320]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x320]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x42d898
lea eax, [ebp - 0x300]
push eax
mov eax, dword [ebp - 0x310]
push eax
push 0xc
call sub.KERNEL32.DLL_RaiseException
mov esi, eax
test esi, esi
jne 0x42d91a
call fcn.0042d10c
mov eax, dword [ebp - 0x304]
call fcn.0042d670
mov eax, dword [ebp - 0x304]
mov word [eax], 0x200c
mov eax, dword [ebp - 0x304]
mov dword [eax + 8], esi
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x42d95e
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x42d951
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.0042d790
pop ecx
test al, al
je 0x42d9be
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_SetEvent
call fcn.0042d3b4
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x100]
push eax
push esi
call sub.KERNEL32.DLL_SetEvent
call fcn.0042d3b4
mov eax, dword [ebp - 0x318]
mov edx, eax
mov eax, dword [ebp - 0x31c]
call dword [ebp - 0x308]
push ebp
mov eax, ebx
call fcn.0042d7c0
pop ecx
test al, al
jne 0x42d95e
jmp 0x42d9df
push ebx
mov eax, dword [ebp - 0x304]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
call fcn.0042d3b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435708
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00435650
push eax
call sub.KERNEL32.DLL_ResumeThread
call fcn.0042d3b4
pop ebx
ret
Function at 0x4357ac
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
lea ecx, [ebp - 8]
lea edx, [ebp - 2]
mov eax, dword [ebp + 0xc]
call fcn.00435508
test al, al
jne 0x4357cf
mov eax, 0x80070057
call fcn.0042d3b4
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, dword [ebp + 0x10]
je 0x4357e4
mov eax, 0x8002000b
call fcn.0042d3b4
lea eax, [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_LockResource
xor eax, eax
push ebp
push 0x43586c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx ebx, word [ebp - 2]
and bx, 0xfff
movzx ebx, bx
cmp ebx, 0xc
jne 0x435831
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetEvent
call fcn.0042d3b4
mov eax, dword [ebp - 0xc]
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.0042dadc
jmp 0x43584b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
call fcn.0042d3b4
mov word [ebp - 0x1c], bx
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.0042dadc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435873
lea eax, [ebp - 0x1c]
call fcn.0042d670
ret