joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426017
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xfa4]
push edi
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0xfa4]
push esi
push eax
call fcn.00438709
push 0x3c
xor edi, edi
lea eax, [ebp - 0xfe0]
push edi
push eax
call fcn.00429bd0
add esp, 0x14
mov dword [ebp - 0xfdc], 0x200
xor eax, eax
mov dword [ebp - 0xfcc], esi
inc eax
mov ecx, str.open
mov dword [ebp - 0xfd4], ecx
push eax
push edi
push edi
push esi
push ecx
push edi
mov dword [ebp - 0xfc4], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4260a9
push edi
push edi
lea eax, [ebp - 0xfa4]
push edi
push eax
call fcn.00426143
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00415db5
mov esp, ebp
pop ebp
ret

Function at 0x4260b9
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0043872b
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00416179
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.00438709
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x426133
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x42612a
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x426120
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x426131
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x4260fd
jmp 0x426133
xor edi, edi
push esi
call fcn.00416182
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426143
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x5596f0
call fcn.00447a0c
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.00429bd0
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.00429bd0
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x426221
cmp word [edi], dx
jne 0x4261b2
mov eax, edx
jmp 0x4261b9
push edi
call fcn.0043872b
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.004071b0
cmp dword [ebp - 0x30], 0
je 0x426221
mov edi, 0x5b6804
push edi
call fcn.0043872b
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004071b0
xor edi, edi
cmp word [esi], di
jne 0x4261ea
mov eax, edi
jmp 0x4261f1
push esi
call fcn.0043872b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004065c0
mov esi, 0x55b738
push esi
call fcn.0043872b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004065c0
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004066f0
jmp 0x42623d
xor edi, edi
cmp word [esi], di
jne 0x42622c
mov eax, edi
jmp 0x426233
push esi
call fcn.0043872b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004071b0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push 1
push edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42626a
mov esi, edi
jmp 0x426295
cmp byte [ebp + 0x10], 0
je 0x426282
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00407400
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00407400
mov eax, esi
call fcn.004479c7
ret

Function at 0x4262b3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0043872b
pop ecx
test eax, eax
je 0x426316
push ebx
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.00429bd0
add esp, 0xc
mov dword [ebp - 0x38], 0x200
xor ebx, ebx
mov dword [ebp - 0x28], esi
inc ebx
mov eax, str.open
mov dword [ebp - 0x30], eax
push ebx
push edi
push edi
push esi
push eax
push edi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x426312
push edi
push edi
push edi
push esi
call fcn.00426143
add esp, 0x10
jmp 0x426314
mov eax, ebx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42631b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x828]
push edi
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.00429bd0
mov dword [ebp - 0x828], ebx
lea eax, [ebp - 0x7e4]
push 0x10
xor ebx, ebx
push ebx
push eax
call fcn.00429bd0
push esi
lea eax, [ebp - 0x7d4]
push 0x5b4714
push eax
call fcn.0041ce34
add esp, 0x24
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x828]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4263d0
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415db5
mov esp, ebp
pop ebp
ret

Function at 0x4263e1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
push 0x44
xor ebx, ebx
push ebx
push eax
call fcn.00429bd0
push 0x10
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x82c], 0x44
push ebx
push eax
call fcn.00429bd0
push esi
lea eax, [ebp - 0x7d4]
push 0x5b4714
push eax
call fcn.0041ce34
add esp, 0x24
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x426496
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x7e8]
push eax
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00415db5
mov esp, ebp
pop ebp
ret
Function at 0x426894
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4269d7
push esi
call fcn.004269f6
pop ecx
test eax, eax
je 0x4268cd
xor eax, eax
inc eax
jmp 0x4269d7
push ebx
push edi
xor edi, edi
push edi
push 0x80
push 4
push edi
push 1
push bind
push esi
mov dword [ebp - 0x110], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x426905
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x110], eax
lea esi, [edi + 1]
push esi
call fcn.00416179
and dword [ebp - 0x118], 0
mov edi, eax
pop ecx
push 0
lea eax, [ebp - 0x118]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00429bd0
lea eax, [ebp - 0x108]
push str.857dbabbbd6f1682eb3cef8e75d5af76
push eax
call fcn.00438d20
lea eax, [ebp - 0x108]
push eax
call fcn.00438750
mov esi, dword [ebp - 0x110]
add esp, 0x18
mov dword [ebp - 0x114], eax
xor eax, eax
mov dword [ebp - 0x10c], eax
test esi, esi
jle 0x4269c8
mov ecx, dword [ebp - 0x108]
mov edx, edi
cmp byte [edx], cl
jne 0x4269bc
xor ecx, ecx
xor ebx, ebx
cmp dword [ebp - 0x114], ecx
jle 0x4269b6
mov al, byte [edx + ecx]
cmp al, byte [ebp + ecx - 0x108]
jne 0x4269b0
mov eax, dword [ebp - 0x114]
inc ebx
cmp ebx, eax
je 0x4269e6
inc ecx
cmp ecx, eax
jl 0x426994
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x108]
inc eax
inc edx
mov dword [ebp - 0x10c], eax
cmp eax, esi
jl 0x426984
test edi, edi
je 0x4269d3
push edi
call fcn.00416182
pop ecx
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00415db5
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x4269f1
push edi
call fcn.00416182
pop ecx
xor eax, eax
inc eax
jmp 0x4269d5
Function at 0x4269f6
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x426b3a
push ebx
push edi
xor edi, edi
xor ebx, ebx
push edi
push 0x80
push 4
push edi
inc ebx
mov dword [ebp - 0x10c], edi
push ebx
push bind
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x426a57
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10c], eax
jmp 0x426a5d
mov eax, dword [ebp - 0x10c]
lea esi, [eax + 1]
push esi
call fcn.00416179
and dword [ebp - 0x11c], 0
pop ecx
push 0
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x118], eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00429bd0
lea eax, [ebp - 0x108]
push str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
push eax
call fcn.00438d20
lea eax, [ebp - 0x108]
push eax
call fcn.00438750
mov edi, dword [ebp - 0x10c]
add esp, 0x18
mov dword [ebp - 0x114], eax
xor eax, eax
mov dword [ebp - 0x110], eax
test edi, edi
jle 0x426b28
mov edx, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x108]
cmp byte [edx], cl
jne 0x426b1c
xor ecx, ecx
xor esi, esi
cmp dword [ebp - 0x114], ecx
jle 0x426b16
mov al, byte [edx + ecx]
cmp al, byte [ebp + ecx - 0x108]
jne 0x426b10
mov eax, dword [ebp - 0x114]
inc esi
cmp esi, eax
je 0x426b2a
inc ecx
cmp ecx, eax
jl 0x426af4
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x108]
inc eax
inc edx
mov dword [ebp - 0x110], eax
cmp eax, edi
jl 0x426ae4
xor ebx, ebx
push dword [ebp - 0x118]
call fcn.00416182
pop ecx
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00415db5
mov esp, ebp
pop ebp
ret

Function at 0x426ba0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00429bd0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
pop esi
jne 0x426c02
xor eax, eax
inc eax
cmp dword [ebp - 0x118], 0
je 0x426bfc
cmp dword [ebp - 0x118], eax
jne 0x426c02
cmp byte [ebp - 6], 1
je 0x426c04
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415db5
mov esp, ebp
pop ebp
ret
Function at 0x426c12
Capabilities:
Enumerate processes

Disassembly:
push 0x678
mov eax, 0x5597ce
call fcn.00447a0c
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x67c]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.00429bd0
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00429bd0
add esp, 0x18
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x426c60
xor eax, eax
jmp 0x426cc6
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x67c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x426cb8
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00438709
lea eax, [ebp - 0x218]
push eax
call fcn.00438c71
lea eax, [ebp - 0x218]
push eax
call fcn.00426810
add esp, 0x10
test al, al
jne 0x426ccc
lea eax, [ebp - 0x67c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x426c79
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
call fcn.004479c7
ret
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00429bd0
add esp, 0xc
push dword [ebp - 0x674]
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push ebx
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
sub esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.00406c80
sub esp, 0x18
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.00406c80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.00425f3b
xor esi, esi
mov ecx, edi
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.00427327
lea ecx, [ebp - 0x450]
call fcn.00425f93
mov eax, esi
jmp 0x426cc6

Function at 0x426e7c
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00429bd0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
pop esi
jg 0x426edf
cmp dword [ebp - 0x118], 2
jg 0x426edf
xor eax, eax
inc eax
jmp 0x426ee1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415db5
mov esp, ebp
pop ebp
ret
Function at 0x426fa8
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x61c]
push esi
xor edi, edi
push edi
push eax
call fcn.00429bd0
lea eax, [ebp - 0x61c]
push 0x55b5d0
push eax
call fcn.00438709
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._sgswb.log
push eax
call fcn.0041ce34
push esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.00429bd0
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00429bd0
add esp, 0x38
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00429304
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x42715c
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0043872b
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.00438709
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.0041ce34
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push 0xfff
push 0x5ce968
call fcn.00415860
xor eax, eax
add esp, 0x30
mov word [0x5d0966], ax
lea eax, [ebp - 0x414]
push eax
call esi
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x55b5e0
push eax
cmovne edi, ebx
call fcn.00432881
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42715b
test edi, edi
jne 0x427108
push esi
push 2
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x82c], 0xfeff
push ebx
push eax
call fcn.00439286
add esp, 0x10
mov edi, 0x5ce968
push edi
call fcn.0043872b
push esi
add eax, eax
push eax
push ebx
push edi
call fcn.00439286
push esi
push 2
lea eax, [ebp - 0x828]
mov dword [ebp - 0x828], 0xd
push ebx
push eax
call fcn.00439286
push esi
push 2
lea eax, [ebp - 0x828]
mov dword [ebp - 0x828], 0xa
push ebx
push eax
call fcn.00439286
push esi
call fcn.0043267f
add esp, 0x38
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00415db5
mov esp, ebp
pop ebp
ret
Function at 0x42786f
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe64
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 0xe10], ax
lea edi, [ebp - 0xe0e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xe10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ebx, 0x208
lea eax, [ebp - 0x630]
push ebx
xor edi, edi
push edi
push eax
call fcn.00429bd0
push str.UseVestige.ini
push 0x5b2dc4
push 0x5d20b0
lea eax, [ebp - 0x630]
push 0x55bc48
push eax
call fcn.00406c50
add esp, 0x20
lea eax, [ebp - 0x630]
push eax
push 0xffffffffffffffff
push 0x55bf34
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [ebp - 0xe0a]
cmp eax, ecx
je 0x427a80
push ebx
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.00429bd0
push ebx
lea eax, [ebp - 0x428]
push edi
push eax
call fcn.00429bd0
lea eax, [ebp - 0x428]
push 0x5d1ea8
push eax
call fcn.00438709
lea eax, [ebp - 0x428]
push str.WnPYCore.exe
push eax
call fcn.00438698
lea eax, [ebp - 0x220]
push 0x5b6804
push eax
call fcn.00438709
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00438698
lea eax, [ebp - 0x220]
push str.__UpDmpInfo
push eax
call fcn.00438698
add esp, 0x40
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.00438698
mov esi, 0x5d22b8
push esi
call fcn.0043872b
add esp, 0xc
test eax, eax
je 0x4279bf
lea eax, [ebp - 0x220]
push 0x55b410
push eax
call fcn.00438698
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.00438698
add esp, 0x10
push 0x44
pop esi
push esi
lea eax, [ebp - 0xe64]
push edi
push eax
call fcn.00429bd0
push 0x10
lea eax, [ebp - 0xe20]
mov dword [ebp - 0xe64], esi
push edi
push eax
call fcn.00429bd0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xe00]
push 0x5b4714
push eax
call fcn.00406c50
add esp, 0x24
lea eax, [ebp - 0xe20]
push eax
lea eax, [ebp - 0xe64]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
lea eax, [ebp - 0xe00]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x427a3d
push dword [ebp - 0xe20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xe1c]
call esi
xor eax, eax
lea edi, [ebp - 0x16]
mov word [ebp - 0x18], ax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0xe0a]
push eax
lea eax, [ebp - 0x18]
push 0x5b471c
push eax
call fcn.00406c50
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x55bf34
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415db5
mov esp, ebp
pop ebp
ret
Function at 0x427e0c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x5c100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x414]
push str._s.
push eax
call fcn.00406c50
add esp, 0xc
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x427f15
lea eax, [ebp - 0x664]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x427f15
push 0x2e
pop eax
cmp word [ebp - 0x638], ax
je 0x427e64
cmp word [ebp - 0x636], bx
je 0x427e64
cmp word [ebp - 0x636], ax
jne 0x427ea1
cmp word [ebp - 0x634], bx
je 0x427e64
test byte [ebp - 0x664], 0x10
je 0x427efc
cmp byte [ebp + 0x10], bl
je 0x427e64
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00429bd0
lea eax, [ebp - 0x638]
push eax
push dword [ebp - 0x668]
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.00406c50
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00427e0c
add esp, 0x28
test al, al
je 0x427e64
jmp 0x427f13
lea eax, [ebp - 0x638]
push edi
push eax
call fcn.00430c1e
pop ecx
pop ecx
test eax, eax
jne 0x427e64
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415db5
mov esp, ebp
pop ebp
ret

Function at 0x43cdf3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043cab3

Function at 0x4400d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043ff52
Function at 0x452d50
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x452d99
mov al, byte [esi]
push eax
call fcn.0045ee70
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x452d77
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x454140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x454161
cmp dword [esi + 0x8c], 0
je 0x454161
push 2
push 3
push esi
call fcn.0045f440
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00461000
add esp, 4
test esi, esi
je 0x454184
cmp dword [esi + 0x8c], 0
je 0x454184
push 3
push esi
call fcn.0045f480
add esp, 8
pop esi
pop ebp
ret

Function at 0x454e10
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2b0], 2
jne 0x454e25
pop ebp
jmp fcn.00454dc0
mov al, 1
pop ebp
ret