joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428d90
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d841
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x470], edi
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
push 0x410
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
call fcn.004b0810
add esp, 0xc
test edi, edi
je 0x428fa8
cmp edi, 4
je 0x428fa8
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x428e97
push 0x207
lea eax, [ebp - 0x420]
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x428eb4
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428e50
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.00419030
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x438]
mov ecx, esi
push eax
call fcn.004257f0
lea ecx, [ebp - 0x438]
call fcn.00413940
jmp 0x428fcd
push dword [ebp - 0x470]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x428f59
push 0x207
lea eax, [ebp - 0x420]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x428f52
xor eax, eax
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x468]
call fcn.00425830
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.00428490
add esp, 8
mov byte [ebp - 0x469], al
lea ecx, [ebp - 0x468]
call fcn.00413940
cmp byte [ebp - 0x469], 0
je 0x428f47
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x438]
call fcn.00425bc0
lea ecx, [ebp - 0x450]
call fcn.00413940
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x438]
mov dword [esi + 0x14], 0
xor eax, eax
movups xmmword [esi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
call fcn.00413940
jmp 0x428fcd
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
Function at 0x4296a0
Capabilities:
Check if file exists
Delete file
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d916
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x218]
push str.PCStore.lnk
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xb
xor eax, eax
mov dword [ebp - 0x440], 0
push str.PCStore.lnk
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
call fcn.00419030
xor eax, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
lea edx, [ecx + 2]
mov word [ebp - 0x438], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429793
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.00419030
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x438]
push eax
push 0x150b
call fcn.00428920
mov edx, dword [ebp - 0x424]
add esp, 0xc
cmp edx, 8
jb 0x429814
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42980a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4298f3
push edx
push ecx
call fcn.0045590a
add esp, 8
mov edx, dword [ebp - 0x43c]
xor eax, eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
cmp edx, 8
jb 0x429871
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429867
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4298f8
push edx
push ecx
call fcn.0045590a
add esp, 8
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4298da
lea eax, [ebp - 0x420]
mov dword [ebp - 0x456], 0
mov dword [ebp - 0x468], eax
xorps xmm0, xmm0
mov eax, 0x614
movlpd qword [ebp - 0x45e], xmm0
mov word [ebp - 0x460], ax
lea eax, [ebp - 0x470]
push eax
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 3
mov dword [ebp - 0x464], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
call fcn.004ba344
call fcn.004ba344
int3
Function at 0x429c00
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d948
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x596334]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429c7b
test al, 0x10
je 0x429c7b
push esi
mov edi, 1
call fcn.004242c0
add esp, 4
test eax, eax
jne 0x429c9e
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x429c9e
push esi
test edi, edi
jne 0x429c96
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x429c9e
push esi
push str.DeleteFile:_s_suceesss
call fcn.0042be60
add esp, 8
jmp 0x429c9e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x429c4c
push esi
push str.DeleteFile:_s_suceesss
call fcn.0042be60
add esp, 8
jmp 0x429c9e
call fcn.004242c0
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x429d1f
push esi
lea ecx, [ebp - 0x10]
call fcn.00409d40
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov edi, dword [esi + 4]
cmp dword [esi + 8], edi
je 0x429cde
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00407b00
add eax, 0x10
add esp, 4
mov dword [edi], eax
add dword [esi + 4], 4
jmp 0x429cea
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push edi
call fcn.004253b0
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429d0c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42ba20
Capabilities:
Check if file exists
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push esi
lea esi, [ecx + 0x2c]
mov ecx, dword [eax]
mov eax, dword [esi]
push edi
lea edx, [ecx - 0x10]
lea edi, [eax - 0x10]
cmp edx, edi
je 0x42ba84
cmp dword [edi + 0xc], 0
push ebx
lea ebx, [edi + 0xc]
jl 0x42ba76
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x42ba76
push edx
call fcn.00407b00
add esp, 4
mov dword [ebp + 8], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x42ba6f
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
jmp 0x42ba83
push dword [ecx - 0xc]
push ecx
mov ecx, esi
call fcn.0040b260
mov eax, dword [esi]
pop ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42baea
mov eax, dword [esi]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
cmp dword [eax - 0xc], 0
je 0x42baea
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42bad1
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jl 0x42baea
jg 0x42bae2
cmp dword [ebp - 8], 0x40000000
jbe 0x42baea
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x432830
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a30
call fcn.00455d30
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20a
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x550a34
push dword [esi + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call esi
push 0x800
lea eax, [ebp - 0x2230]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x2230]
push 1
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x1230]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x2230]
push 0x556678
push eax
lea eax, [ebp - 0x1230]
push eax
call esi
push 0x410
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.004b0810
push 0x104
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x1230]
push eax
call fcn.00435ec0
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004e52bb
add esp, 0x20
test eax, eax
jne 0x43291f
lea eax, [ebp - 0x1230]
push eax
call fcn.00424e70
add esp, 4
push 0x800
lea eax, [ebp - 0x2a30]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x2a30]
push 1
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x1a30]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x2a30]
push 0x556678
push eax
lea eax, [ebp - 0x1a30]
push eax
call esi
push 0x410
lea eax, [ebp - 0xa30]
push 0
push eax
call fcn.004b0810
push 0x104
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x1a30]
push eax
call fcn.00435ec0
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004e52bb
add esp, 0x20
pop esi
test eax, eax
jne 0x4329c8
lea eax, [ebp - 0x1a30]
push eax
call fcn.00424e70
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
Function at 0x433ca0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x433d7b
test ecx, ecx
je 0x433d7b
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x433d7b
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x433d7b
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x433d66
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push dword [ebp - 0x4c4]
call fcn.004e8a11
add esp, 0xc
test eax, eax
je 0x433d8e
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x433d10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x4c0]
call fcn.00434ac0
xor ecx, ecx
test edi, edi
je 0x433dac
cmp edi, 0x7fffffff
jbe 0x433db1
mov ecx, 0x80070057
test ecx, ecx
js 0x433de7
mov eax, dword [ebp - 0x4c0]
mov esi, edi
test edi, edi
je 0x433dcf
cmp word [eax], 0
je 0x433dcf
add eax, 2
sub esi, 1
jne 0x433dc1
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x433de9
xor esi, esi
test ecx, ecx
js 0x433e3a
mov eax, dword [ebp - 0x4c0]
mov edx, edi
lea ecx, [eax + esi*2]
sub edx, esi
je 0x433e2d
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
lea eax, [ebx + ebx]
sub eax, ecx
add edi, eax
test esi, esi
je 0x433e2d
movzx eax, word [edi + ecx]
test ax, ax
je 0x433e2d
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x433e14
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
Function at 0x433e50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x433ec8
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret

Function at 0x433f80
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00455d30
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
je 0x4340ba
mov edi, dword [ebp + 0x10]
cmp edi, 0x64
jl 0x4340ba
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4340ba
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x1008], eax
test eax, eax
je 0x43408f
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004b0810
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.004b15c4
add esp, 0x14
test eax, eax
je 0x434054
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x434054
mov ecx, 1
jmp 0x434056
xor ecx, ecx
test ecx, ecx
lea edx, [ebp - 0x1004]
lea eax, [ebp - 0x804]
cmovne eax, edx
push eax
push edi
push ebx
call fcn.00434ac0
mov edi, dword [ebp - 0x1008]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x43406f
push edi
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.00433ca0
add esp, 0xc
mov edi, eax
jmp 0x434075
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
Function at 0x434730
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x57fe88
push fcn.004b1aa0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a14
call fcn.00455d30
mov eax, dword [0x596334]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a2c], esi
test esi, esi
je 0x434904
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434786
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x434904
mov dword [ebp - 4], 0
call fcn.00433e50
mov dword [ebp - 4], 0xfffffffe
jmp 0x4347cc
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.004b0810
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.004b0810
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x434904
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.004e2cf6
lea eax, [ebp - 0x224]
push eax
call fcn.004e1ce5
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x2a28], edi
jbe 0x434904
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + edi*4 - 0x2a24]
call fcn.00433f80
add esp, 0xc
test eax, eax
je 0x4348f7
lea eax, [ebp - 0xa24]
push eax
call fcn.004e1ce5
add esp, 4
lea ecx, [ebp - 0xa24]
lea eax, [ebp - 0x224]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4348b8
test dx, dx
je 0x4348b4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4348b8
add eax, 4
add ecx, 4
test dx, dx
jne 0x434892
xor eax, eax
jmp 0x4348bd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4348f7
push dword [ebp + edi*4 - 0x2a24]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4348e3
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa24]
push eax
push str.Kill_process:__s
call fcn.0042be60
add esp, 8
inc edi
cmp edi, dword [ebp - 0x2a28]
jb 0x434854
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret 4
Function at 0x434930
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x57fec8
push fcn.004b1aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x596334]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
test esi, esi
je 0x434a91
cmp word [esi], 0
je 0x434a91
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434990
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x434a91
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x434a91
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.004b0810
push esi
push str.__s_
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.00425130
push 0x3c
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.004b0810
add esp, 0x28
mov dword [ebp - 0x858], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x84c], 0x553e44
mov dword [ebp - 0x844], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x854], 0x440
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x434a58
cmp dword [ebp + 0x18], 0
je 0x434a58
push dword [ebp + 0x20]
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x434a6d
test esi, esi
je 0x434a7d
push edi
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x434a7d
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x434a9a
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x434b40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x434b5c
pop edi
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
Function at 0x434cb0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x434d71
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x434d5b
push edi
push 0x104
lea edi, [ebx + 4]
push 0
push edi
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push 0
push 0x556a74
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
pop edi
cmp dword [ebx], 0
jne 0x434d71
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004b0810
add esp, 0xc
mov dword [ebp - 0x314], 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push 0x207
push eax
call fcn.00405260
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004d4495
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x434dd1
cmp eax, 0x207
ja 0x434dd1
jne 0x434dd8
mov byte [ebp - 0x109], 0
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434de1
push 0
lea eax, [ebp - 0x314]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00455d1a
mov esp, ebp
pop ebp
ret

Function at 0x4353b0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x556ac4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x556ac8]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x435429
lea eax, [ebp - 0xc]
push eax
call fcn.00435440
add esp, 4
test eax, eax
jne 0x435429
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
push 0
lea eax, [ebp - 0xc]
movlpd qword [ebp - 0x14], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x435429
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
xor edx, edx
call fcn.00455d1a
mov esp, ebp
pop ebp
ret