joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bbe1
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x46f487
call fcn.00453e8c
sub esp, 0xad4
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xade]
mov word [ebp - 0xae0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xae0]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0xae0]
mov edi, 0x4755e0
mov esi, 0x4755d8
mov dword [ebp - 0x68], edi
test eax, eax
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0xae0]
jne 0x41bc45
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, 0x48b120
mov dword [ebp - 4], ebx
mov ecx, eax
mov dword [ebp - 0x3c], edi
test ecx, ecx
mov dword [ebp - 0x1c], esi
jne 0x41bc6c
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x68]
push eax
mov byte [ebp - 4], 1
call fcn.00423bb5
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00401093
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 2
cmp eax, ebx
jne 0x41bca5
mov eax, 0x4755fc
lea ecx, [ebp - 0x2e0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x41bd9d
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x41bd77
lea eax, [ebp - 0xae0]
mov dword [ebp - 0x3c], edi
test eax, eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0xae0]
jne 0x41bcf5
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 3
test eax, eax
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x70], esi
lea eax, [ebp - 0x2b4]
jne 0x41bd25
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x90]
call fcn.004011a9
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 4
call fcn.00423bb5
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.00401093
mov eax, dword [ebp - 0x34]
cmp eax, ebx
jne 0x41bd64
mov eax, 0x4755fc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00401093
lea eax, [ebp - 0x2e0]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41bcc2
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
cmp eax, ebx
je 0x41bd9d
push dword [ebp - 0x14]
call eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x421b0c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x46ff42
call fcn.00453e8c
sub esp, 0x290
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x12]
mov ebx, 0x4755e0
mov esi, 0x4755d8
push edi
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 1
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x24], esi
call fcn.0040190c
push dword [ebp + 0xc]
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 2
push eax
call fcn.00421ce6
mov eax, dword [eax + 8]
pop ecx
cmp eax, edi
pop ecx
jne 0x421b69
mov eax, 0x4755fc
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.00416df6
neg eax
sbb al, al
lea ecx, [ebp - 0x6c]
inc al
mov byte [ebp + 0xf], al
call fcn.00401093
cmp byte [ebp + 0xf], 0
je 0x421c9e
mov word [ebp - 0x29c], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x29a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
and dword [ebp + 0xc], 0
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0x48c0f8
mov dword [ebp - 0x1c], 0x104
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421bfe
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xf]
push 0
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.0040190c
mov dword [ebp - 0x18], 1
jmp 0x421cba
lea eax, [ebp - 0x29c]
mov edi, 0x493568
test eax, eax
lea eax, [ebp - 0x29c]
jne 0x421c15
mov eax, edi
push eax
lea ecx, [ebp - 0x44]
call fcn.0040b32d
mov eax, 0x48c0f4
mov dword [ebp - 0x6c], ebx
mov ecx, eax
mov dword [ebp - 0x4c], esi
test ecx, ecx
jne 0x421c31
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x6c]
call fcn.004011a9
mov eax, 0x48c0f0
mov byte [ebp - 4], 3
mov ecx, eax
mov dword [ebp - 0x94], ebx
test ecx, ecx
mov dword [ebp - 0x74], esi
jne 0x421c5a
mov eax, edi
lea ecx, [ebp - 0x11]
push 0
push ecx
push eax
lea ecx, [ebp - 0x94]
call fcn.004011a9
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x44]
push eax
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 4
call fcn.00423dad
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 3
call fcn.00401093
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.00401093
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.00401d8c
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00401093
cmp dword [ebp - 0x10], 0
je 0x421cd5
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x422e78
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4701b4
call fcn.00453e8c
push ecx
mov eax, 0x302c
call fcn.004545d0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x422ef9
call esi
cmp byte [ebp + 0x14], bl
je 0x422ed6
cmp eax, 0x20
je 0x422ecf
cmp eax, 0x21
jne 0x422ed6
xor eax, eax
jmp 0x423019
cmp eax, ebx
jle 0x422ee6
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x422ef9
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push 0x47fd10
push eax
call fcn.00455086
push 0x2800
call fcn.00453fde
cmp eax, ebx
mov edi, eax
pop ecx
mov dword [ebp - 0x2c], edi
setne byte [ebp - 0x30]
mov byte [ebp - 4], 1
mov dword [ebp + 0x14], ebx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x2800
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004388d3
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x422f74
mov dword [ebp - 0x2038], eax
lea eax, [ebp - 0x2034]
push ebx
push eax
call fcn.00454629
pop ecx
lea esi, [ebp - 0x2038]
pop ecx
lea edi, [ebp - 0x1034]
mov ecx, 0x401
lea eax, [ebp - 0x1034]
mov word [ebp - 0x1834], bx
push 0x47fd00
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00455086
cmp dword [ebp + 0xc], ebx
je 0x422fed
lea eax, [ebp - 0x1c]
push ebx
push eax
push dword [ebp + 0xc]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x422fba
call esi
test eax, eax
jg 0x422f99
call esi
jmp 0x422fa5
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x422fba
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push 0x47fd10
push eax
call fcn.00455086
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
je 0x422fed
call esi
test eax, eax
jg 0x422fcc
call esi
jmp 0x422fd8
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x422fed
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push 0x47fd10
push eax
call fcn.00455086
mov eax, dword [ebp + 0xc]
add dword [ebp + 0x14], eax
cmp eax, ebx
ja 0x422f16
cmp byte [ebp - 0x30], bl
je 0x423007
push edi
call fcn.004389b2
pop ecx
cmp dword [ebp - 0x14], 0xffffffff
je 0x423016
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x42384a
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x4702b0
call fcn.00453e8c
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
and dword [ebp - 4], 0
cmp edi, eax
je 0x42388c
push ebx
lea ebx, [edi + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x423879
mov eax, 0x475650
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add edi, 0x28
add ebx, 0x28
cmp edi, dword [esi + 0x30]
jne 0x42386e
pop ebx
mov eax, dword [esi + 8]
test eax, eax
jne 0x423898
mov eax, 0x475650
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esi + 0x28]
call fcn.004079cc
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402424
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x426988
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4707e2
call fcn.00453e8c
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.004559c4
mov eax, 0x476c08
lea edi, [ebx + 0x10]
mov esi, eax
and dword [ebp - 4], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x30]
lea eax, [ebp - 0xd]
mov edi, 0x4755e0
mov esi, 0x4755d8
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.0040190c
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.0040190c
mov eax, dword [ebp + 8]
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebx], 0x475808
mov dword [ebx + 0xc], eax
call fcn.00426b16
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x426a1a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x47080a
call fcn.00453e8c
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.004559c4
and dword [ebp - 4], 0
lea edi, [ebx + 0x30]
lea eax, [ebp - 0xd]
mov esi, 0x4755d8
push 0
push eax
mov ecx, edi
mov dword [edi], 0x4755e0
mov dword [edi + 0x20], esi
call fcn.0040190c
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], 0x4755e0
mov dword [ecx + 0x20], esi
call fcn.0040190c
mov esi, dword [ebp + 8]
mov dword [ebx], 0x475808
mov ecx, edi
mov byte [ebp - 4], 2
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [esi + 0x30]
push eax
call fcn.00401d42
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
call fcn.00401d42
add esi, 0x20
lea edi, [ebx + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x10]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4291f9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
and dword [ebp - 0x14], 0
push esi
push edi
mov edi, ecx
call fcn.0040116a
push 1
lea eax, [ebp - 0x150]
pop esi
mov dword [ebp - 0x150], 0x114
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 4], eax
sub eax, 0
mov dword [ebp - 8], ecx
je 0x4292a9
dec eax
je 0x42929e
dec eax
jne 0x4292b0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], 2
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x3c]
push 4
dec eax
pop ecx
je 0x42928e
dec eax
je 0x429285
dec eax
jne 0x429291
mov dword [ebp - 0x18], 5
jmp 0x429291
mov dword [ebp - 0x18], 3
jmp 0x429291
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x14c], ecx
jb 0x4292b0
mov dword [ebp - 0x14], esi
jmp 0x4292b0
movzx eax, cx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jmp 0x4292b0
mov dword [ebp - 0x18], 7
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00401166
mov ecx, eax
call fcn.0042a5d5
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x4296f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
dec edx
test eax, eax
je 0x42972d
mov eax, dword [ecx + 0xd8]
push esi
lea esi, [edx + 1]
mov edx, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
movzx edi, byte [edx]
and ecx, 0xff
xor ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 8
mov ecx, dword [eax + ecx*4]
inc edx
xor edi, ecx
dec esi
mov dword [ebp + 0x10], edi
jne 0x42970b
pop edi
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x42db01
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4711f9
call fcn.00453e8c
sub esp, 0x8d0
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x8da]
mov word [ebp - 0x8dc], bx
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x8dc]
lea ecx, [esi + 0x18]
push eax
push 0x493568
push 0x48d364
push 0x489360
call fcn.00402b35
cmp word [ebp - 0x8dc], bx
jne 0x42db63
xor eax, eax
jmp 0x42dcbf
lea eax, [ebp - 0xdc]
mov ecx, esi
push eax
call fcn.0042a6a1
mov eax, dword [eax + 8]
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x42db80
mov eax, 0x475650
mov edi, 0x4755e0
mov esi, 0x4755d8
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x42db99
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 2
call fcn.00402424
lea eax, [ebp - 0x8dc]
mov dword [ebp - 0x64], edi
test eax, eax
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x8dc]
jne 0x42dbd1
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x64]
call fcn.004011a9
push ebx
lea eax, [ebp - 0xb4]
push ebx
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.00411c3d
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
push ecx
lea ecx, [ebp - 0x8c]
push ecx
mov ecx, eax
call fcn.0040aa68
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.00401d42
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 4
call fcn.00401093
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.00401093
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.00401093
push 4
lea eax, [ebp - 0xd]
sub esp, 0x28
lea ecx, [ebp - 0x38]
mov esi, esp
mov dword [ebp - 0x14], esp
push 1
push eax
call fcn.0042edc7
push eax
mov ecx, esi
call fcn.00402d75
call fcn.0043918a
add esp, 0x2c
cmp al, bl
jne 0x42dc8b
lea eax, [ebp - 0x8dc]
test eax, eax
lea eax, [ebp - 0x8dc]
jne 0x42dc82
mov eax, 0x493568
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040b32d
mov eax, dword [ebp - 0x34]
cmp eax, ebx
jne 0x42dc97
mov eax, 0x4755fc
push 1
push ebx
push ebx
push eax
push 0x48d388
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
lea ecx, [ebp - 0x3c]
sbb esi, esi
or dword [ebp - 4], 0xffffffff
neg esi
call fcn.00401093
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x432b06
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esp + 8], 0
je 0x432b22
mov ecx, esi
call fcn.00432b26
pop esi
ret 4

Function at 0x432e1c
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x471cca
call fcn.00453e8c
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x18], esi
or dword [esi + 0x220], 0xffffffff
lea eax, [esi + 0x228]
mov dword [esi + 0x20c], edi
mov dword [esi + 0x210], edi
mov byte [esi + 0x214], 1
mov byte [esi + 0x215], 1
mov byte [esi + 0x216], 1
mov dword [esi + 0x21c], edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
push dword [ebp + 8]
lea ebx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], 0x47603c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
push ebx
call fcn.00432fde
pop ecx
mov dword [esi + 0x218], eax
pop ecx
push edi
push 0x80
push 3
push edi
push 3
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x20c], eax
jne 0x432eca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x21c], eax
jmp 0x432fcb
push 0x2e
mov dword [esi + 0x210], 1
call fcn.00453fde
push 0x2e
push edi
push eax
mov dword [esi + 0x224], eax
call fcn.00454540
add esp, 0x10
mov ecx, esi
push edi
push edi
push dword [esi + 0x218]
push dword [esi + 0x20c]
call fcn.0043419d
test eax, eax
je 0x432fcb
lea eax, [ebp - 0x14]
push edi
push eax
push 0x2e
push dword [esi + 0x224]
push dword [esi + 0x20c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x432fcb
cmp dword [ebp - 0x14], edi
je 0x432fcb
mov ecx, esi
call fcn.004334f4
test eax, eax
je 0x432f51
mov eax, dword [esi + 0x224]
mov ax, word [eax + 0xe]
cmp ax, di
jne 0x432fc0
push edi
push ebx
call fcn.00432fde
cmp eax, dword [esi + 0x218]
pop ecx
pop ecx
jbe 0x432f68
mov dword [esi + 0x218], eax
push edi
push edi
push dword [esi + 0x218]
mov ecx, esi
push dword [esi + 0x20c]
call fcn.0043419d
test eax, eax
je 0x432fcb
lea eax, [ebp - 0x10]
push edi
push eax
push 0x2e
push dword [esi + 0x224]
push dword [esi + 0x20c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x432fcb
cmp dword [ebp - 0x14], edi
je 0x432fcb
mov ecx, esi
call fcn.004334f4
test eax, eax
je 0x432fcb
mov eax, dword [esi + 0x224]
mov ax, word [eax + 0xe]
cmp ax, di
je 0x432fcb
movzx eax, ax
push eax
mov ecx, esi
call fcn.0043409b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x43329f
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov eax, 0x471d00
call fcn.00453e8c
sub esp, 0x4c
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov esi, dword [edi + 0xa8]
cmp esi, eax
je 0x4333aa
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4332e8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
push edi
push 0x48d6ac
call fcn.004333fa
pop ecx
test eax, eax
pop ecx
je 0x433314
cmp dword [eax + 0xc], esi
jne 0x433314
mov ecx, dword [eax + 0x14]
mov edx, dword [edi + 0xac]
mov dword [ebp + 0xc], edx
mov edi, ecx
lea eax, [ecx + ebx]
mov dword [ebp + 0x10], edx
jmp 0x433367
push edi
push 0x48d6a4
call fcn.004333fa
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x43333a
push edi
push 0x48d69c
call fcn.004333fa
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4333aa
mov edi, dword [edi + 0xac]
push 0x1c
mov dword [ebp + 0x10], edi
mov eax, edi
xor edx, edx
pop edi
div edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x4333aa
sub esi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
lea ecx, [eax + esi]
mov edi, ecx
lea eax, [ecx + ebx]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 0x18]
jbe 0x4333b5
cmp dword [ebp + 8], 0
je 0x4333b5
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, edi
xor edx, edx
div dword [ebp - 0x3c]
xor edx, edx
mov esi, eax
mov eax, edi
div dword [ebp - 0x3c]
imul esi, dword [ebp - 0x3c]
add edx, dword [ebp + 0x10]
push edx
push esi
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x4333ae
xor eax, eax
jmp 0x4333eb
mov dword [ebp - 0x10], eax
sub eax, esi
add eax, edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x4333d4
add eax, 0x10
mov ecx, dword [eax]
mov esi, dword [eax + 8]
add esi, ecx
cmp esi, dword [ebp + 0x14]
jbe 0x4333ce
add dword [ebp - 0x14], ecx
add eax, 0x1c
dec edx
jne 0x4333bf
cmp dword [ebp - 0x10], 0
je 0x4333e8
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x4333e8
push dword [ebp - 0x10]
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4338ff
Capabilities:
Get common file path

Disassembly:
mov eax, 0x471d7c
call fcn.00453e8c
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0xd]
mov ebx, 0x475628
mov esi, 0x475620
push 0
push eax
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.00403bf5
and dword [ebp - 4], 0
lea eax, [ebp - 0xe]
push 0
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], esi
call fcn.00403bf5
mov esi, 0x104
lea eax, [ebp - 0x20]
push esi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00402dad
mov ecx, dword [eax]
mov byte [ebp - 4], 2
mov byte [eax + 4], 1
call fcn.00403dc2
push dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00402ebf
lea eax, [ebp - 0x20]
push esi
push eax
mov ecx, edi
call fcn.00402dad
mov ecx, dword [eax]
mov byte [ebp - 4], 3
mov byte [eax + 4], 1
call fcn.00403dc2
mov ecx, dword [ebp - 0x40]
mov eax, dword [eax]
test ecx, ecx
jne 0x4339a9
mov ecx, 0x475650
push eax
push 0
push 0x48d6b4
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00402ebf
and byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00402424
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43409b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
jle 0x434118
mov esi, 0x138
push esi
call fcn.00453fde
mov ebx, eax
push esi
push 0
push ebx
call fcn.00454540
add esp, 0x10
lea eax, [ebp - 8]
push 0
push eax
push esi
push ebx
push dword [edi + 0x20c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x434118
cmp dword [ebp - 8], 0
je 0x434118
push ebx
lea ecx, [edi + 0x228]
call fcn.00434454
push 1
push 0
push dword [ebx + 0x10c]
mov ecx, edi
push dword [edi + 0x20c]
call fcn.0043419d
test eax, eax
je 0x434118
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jl 0x4340b4
pop edi
pop esi
pop ebx
leave
ret 4