joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418e40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2c3a
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 9
xor eax, eax
mov dword [ebp - 0x44], 7
push str.WnUpd.exe
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
call fcn.004020c0
cmp dword [ebp - 0x48], 0
mov dword [ebp - 4], 0
je 0x41901f
xor eax, eax
mov dword [ebp - 0x2c], 7
push eax
push 0x5a6864
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.004020c0
xor eax, eax
mov byte [ebp - 4], 1
push eax
push 0x5a6864
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004020c0
mov eax, dword [0x631024]
mov byte [ebp - 4], 2
test eax, eax
jne 0x418f21
push 0x120
call fcn.00439a09
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x418f16
mov ecx, eax
call fcn.00419d80
jmp 0x418f18
xor eax, eax
mov byte [ebp - 4], 2
mov dword [0x631024], eax
mov ecx, eax
call fcn.0043b31a
mov edx, eax
cmp word [edx], 0
jne 0x418f34
xor ecx, ecx
jmp 0x418f4f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418f40
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004020c0
push 9
push str.WnUpd.exe
lea ecx, [ebp - 0x28]
call fcn.004053e0
push 1
push 0x5a8550
lea ecx, [ebp - 0x40]
call fcn.004020c0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.004052d0
push 2
push 0x5a8554
lea ecx, [ebp - 0x40]
call fcn.004053e0
push 2
push 0x5a85bc
lea ecx, [ebp - 0x40]
call fcn.004053e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418fe1
cmp dword [ebp - 0x2c], 8
lea esi, [ebp - 0x40]
cmovae esi, dword [ebp - 0x40]
call fcn.0042aad9
push esi
test eax, eax
je 0x418fd9
mov ecx, edi
call fcn.00419b30
jmp 0x418fe1
call fcn.0042f1ea
add esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x418ff6
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402210
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x41901f
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402210
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x419034
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00402210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x419b30
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
lea eax, [ebp - 8]
push str.EXPLORER.EXE
push eax
call fcn.004193e0
test eax, eax
jne 0x419b50
xor eax, eax
mov esp, ebp
pop ebp
ret 4
push 0x44
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.00446360
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 4]
mov dword [ebp - 0x54], str.winsta0default
mov dword [ebp - 4], 0
push 1
push dword [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x419b48
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push dword [ebp - 4]
push 0x420
push 0
push 0
push 0
push dword [ebp + 8]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esp, ebp
pop ebp
ret 4

Function at 0x41a850
Capabilities:
Create thread

Disassembly:
push esi
push 4
push 0x5a8708
mov esi, ecx
call fcn.0041b280
lea eax, [esi + 0x34]
push eax
push 0
push esi
push 0x41a8d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
pop esi
ret 8

Function at 0x41b1d0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
push str._s_Failed_error_0x_08lx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041b150
add esp, 0x14
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41b264
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 0x214], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00439cb7
mov esp, ebp
pop ebp
ret 8

Function at 0x41b280
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41b2d6
mov ecx, dword [edi + 4]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41b650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3123
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x62c144]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x6313a8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x6313a8
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5a6500
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0041f1b0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x421dd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x6355c0], ecx
inc eax
cmp eax, 0x100
jb 0x421dd2
cmp eax, 0x800
jae 0x421ea3
nop
mov edx, dword [eax*4 + 0x6351c0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x6355c0]
mov dword [eax*4 + 0x6355c0], edx
inc eax
cmp eax, 0x800
jb 0x421e80
mov dword [0x6313b4], 0x422c40
call fcn.00422a70
mov ecx, dword [0x6313b4]
test eax, eax
mov edx, 0x422ce0
cmove ecx, edx
mov dword [0x6313b4], ecx
ret
Function at 0x422fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x422fe0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x423012
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x42300f
inc esi
cmp esi, edx
jb 0x423000
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x42313c
cmp ecx, 3
jbe 0x423052
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x423090
cmp cl, 0xff
je 0x423090
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x422ff4
dec ecx
shl eax, cl
and eax, 7
je 0x42302a
movzx ecx, byte [eax + 0x5a9154]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5a914c], 0
mov cl, byte [edx + 4]
je 0x42307a
test cl, cl
je 0x42307a
cmp cl, 0xff
jne 0x42302a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x422ff4
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x4230be
lea edx, [edi + ebx]
add edx, esi
jmp 0x4230c4
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x423102
movzx edi, byte [eax + 0x5a9154]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x4230ee
cmp cl, 0xff
jne 0x423102
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x4230b1
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x422ff4
pop edi
pop esi
cmp ecx, 3
jbe 0x423151
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426b82
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
xor ebx, ebx
inc ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x426bb8
xor eax, eax
jmp 0x426c69
call fcn.0043d6c3
test al, al
je 0x426bd9
or byte [ebp + 0x2c513ac0], dl
cmp esp, esp
invalid
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0043d5f4
test al, al
je 0x426c1e
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
pop edi
jmp 0x6e91b590
call fcn.0043d456
test al, al
je 0x426c3c
aam 0x5b
cmc
scasd eax, dword es:[edi]
mov byte [edx - 0x3a36a13], cl
pop ebp
out 0xf7, al
pop ebx
mov dl, bh
movsd dword es:[edi], dword [esi]
mov dword [eax], eax
retf 0x6ee8
call fcn.0043d5af
test al, al
je 0x426c57
pop ds
mov cl, dh
jp 0x426ca3
dec ebp
xor al, 0x9f
and ebx, esi
cdq
int1
popal
int 0
jb 0x426c43
dec edi
cmp dword [ebp - 8], 0
je 0x426c65
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x426c67
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jo 0x426cb5
push eax
Function at 0x429262
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004549d7
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
sal edi, 0xd9
or ecx, eax
push ecx
call fcn.00439cc8
push dword [ebp + 8]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.00454a23
add esp, 0x10
call fcn.0043d792
mov bh, 2
add byte [ebx - 0xe17ef3c], al
inc esp
add dword [eax], eax
test al, al
je 0x4292b5
pop ebx
fidivr word [ebx + 0x3f4216dd]
cdq
xor al, 0xc3
mov bh, 0x94
jbe 0x429306
jecxz 0x429280
mov eax, dword [ebp - 8]
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0xc], ebx
test eax, eax
js 0x42937f
cmp word [edi + ebx*2], 0x5c
jne 0x429370
call fcn.0043d4e0
test al, al
je 0x4292f0
sal byte [esp + edx - 0x29], 0x9e
xlatb
sahf
jo 0x429296
xor dword [0x409b6c76], eax
xlatb
sahf
test al, 0x67
popfd
inc edi
loopne 0x42934a
jns 0x4292d9
call fcn.0043d2fd
test al, al
je 0x42931a
mov esi, dword [ebp + 0xd]
pop ebp
xchg edi, eax
invalid
sub ebp, eax
jo 0x42933e
xchg edx, eax
and ah, byte [edi + 0x3298a90d]
sbb byte [edx], dh
clc
insb byte es:[edi], dx
inc ecx
int3
call fcn.0043d3cc
test al, al
je 0x429345
mov edx, 0x8e275482
shr byte [esi], cl
push 0x13
sbb cl, cl
adc eax, 0xc20bade2
invalid
insd dword es:[edi], dx
je 0x4292f5
push ecx
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
xor eax, eax
push edi
movzx esi, word [edi + ebx*2]
mov word [edi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x429369
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42938f
mov eax, dword [ebp - 8]
mov word [edi + ebx*2], si
inc ebx
mov dword [ebp - 0xc], ebx
cmp ebx, eax
jle 0x4292c8
xor esi, esi
inc esi
push edi
call fcn.00439cd1
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x42937f
Function at 0x429393
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push eax
push 0x1a
push ecx
push eax
mov dword [ebp - 0x210], ebx
call fcn.00429d5b
lea eax, [ebp - 0x20c]
push eax
call fcn.004549d7
add esp, 0x14
mov dword [ebp - 0x214], eax
call fcn.0043d273
test al, al
je 0x42940a
arpl di, bp
mov dword [0x9ba5007e], eax
fdiv dword [edi]
cmpsb byte [esi], byte es:[edi]
sbb dh, bh
invalid
cmp dword [ebp - 0x214], 0
je 0x429516
mov esi, 0x5a6c98
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004549f2
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004549f2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004549f2
add esp, 0x18
call fcn.0043d81c
test al, al
je 0x42946a
std
invalid
scasd eax, dword es:[edi]
sub byte [edx], bl
in eax, 0x6d
jecxz 0x42941f
aam 0xe4
mov ss, word [ebx - 0x6e]
retf 0xbf55
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x429488
lea eax, [ebp - 0x20c]
push eax
call fcn.00429262
pop ecx
call fcn.0043d342
add dword ds:[eax], eax
test al, al
je 0x4294a5
cmc
sar dword [ebx], 0x8f
jp 0x4294c8
daa
add dword [ecx + 0x5f], ecx
fldlg2
push cs
sub dl, byte [ebx]
jns 0x42948a
leave
ret 0xe8df
call fcn.0043d5f4
test al, al
je 0x4294ca
ljmp 0x9517:0xc6d354a9
dec edx
popal
call fcn.0043d81c
test al, al
je 0x4294e8
sub bh, bl
mov edi, dword [0xd9457cb1]
push ecx
xor ah, byte [edx - 0x63]
mov byte [0xb2a7a60d], al
adc eax, dword [esp + esi]
sbb al, 0x66
cmp dword [ebp - 0x20c], 0
cmp word [ebp - 0x20c], 0
jne 0x4294f6
xor eax, eax
jmp 0x429503
lea eax, [ebp - 0x20c]
push eax
call fcn.004549d7
pop ecx
mov ecx, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004020c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x429772
Capabilities:
Get common file path

Disassembly:
or bh, byte [ebp + 0x5ea04410]
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6313c1], 0
push ebx
push esi
push edi
je 0x4297fa
call fcn.0043d342
test al, al
je 0x4297ae
fsub qword [ebx - 0x5a03ff7f]
stc
pop ss
mov ebx, 0xb3144cb6
dec esp
jnp 0x42972d
in eax, dx
invalid
call fcn.0043d5f4
test al, al
je 0x4297d3
pop ss
fstp qword [0xba352c33]
add dl, byte [edi - 0x4f3d5105]
xor al, 0x27
or eax, 0x5df4856f
aaa
mov dword [0x24187555], eax
leave
call fcn.0043d81c
test al, al
je 0x4298f1
pushfd
mov edx, 0xa8833383
fadd dword [ecx + 0x1e]
adc ecx, dword [esi]
cmp edi, dword [ebx + 0x62]
popal
mov ecx, 0xff402d9
xor ch, cl
test dword [eax], 0x1de80000
inc eax
add dword [eax], eax
call fcn.0043d81c
test al, al
je 0x42981e
enter 0xffffffffffffc028, 0xffffffffffffffc4
ret 0x4d05
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00446360
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42988e
lea eax, [ebp - 0x20c]
push eax
call fcn.00452a8c
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.0044656d
add dword [eax], eax
pop ecx
pop ecx
test eax, eax
jne 0x429887
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.0044656d
pop ecx
pop ecx
test eax, eax
je 0x42988e
in al, dx
int3
mov byte [0x6313c1], 1
call fcn.0043d67e
test al, al
je 0x4298a9
int3
call fcn.0043d342
test al, al
je 0x4298cd
test al, 0x4e
jg 0x429868
xchg ebp, eax
aas
mov al, 0xe3
retf 0xfae5
call fcn.0043d342
test al, al
je 0x4298f1
mov dword [ecx], ebp
push ecx
xor eax, dword [esi - 0x3fe7dbe]
inc ecx
imul ebx, dword [eax], 0x61
insb byte es:[edi], dx
push ecx
mov esp, 0xbd77c603
mov dword [0x5e6f957], eax
xchg ebp, eax
jne 0x42987d
mov ecx, dword [ebp - 4]
dec ebp
cld
mov al, byte [0x6313c1]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x429e73
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a4
mov eax, 0x5a3b6b
call fcn.0043a209
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.004037f0
mov esi, 0x5a803c
mov byte [ebp - 4], 1
push esi
call fcn.004549d7

Function at 0x42a10a
Capabilities:
Delete file

Disassembly:
or al, ch
out dx, al
mov dl, 0xff
invalid
push 0
mov eax, 0x5a3b9b
call fcn.0043a1d5
and dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42a209
adc byte [ecx + 0x5a], ah
add byte [ebp - 0x2a7af040], al
add byte [eax], al
add al, ch
iretd
call fcn.0043d708
test al, al
je 0x42a14e
out 0xf4, eax
dec ecx
shr edi, cl
les ebx, [ecx + 0x14]
xchg byte [esi], dh
fdivp st(2)
sub ch, dh
sbb cl, byte [edi]
test eax, ebp
mov esi, 0x84000132
sal byte [edi + ebx - 0x5b], 0xf6
loope 0x42a0fe
call fcn.0043d411
test al, al
je 0x42a176
movsd dword es:[edi], dword [esi]
mul cl
mov dword [0x2cfdfb15], eax
adc eax, 0x9e2cfdfb
sti
std
sub al, 0x9e
sahf
sub eax, 0x7ea39faf
scasd eax, dword es:[edi]
jb fcn.0042a10a
sbb dl, dl
mov ah, byte [ecx + 0x5b9585e7]
jo 0x42a168
add ebp, dword [edx]
ja 0x42a15f
call fcn.0043d22e
mov bl, 0x30
add dword [eax], eax
test al, al
je 0x42a195
pop ebp
inc edx
sbb al, 0xed
stosd dword es:[edi], eax
dec eax
jle 0x42a176
jmp 0x42a128
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call int.00425ea8
pop ecx
call fcn.0043d81c
test al, al
je 0x42a1c3
invalid
loop 0x42a15c
mov eax, dword [0xcae84181]
xor eax, 0xc0840001
call fcn.0043d792
test al, al
je 0x42a1e7
mov esi, 0x9e84dc07
ret
call fcn.0043d74d
test al, al
je 0x42a209
adc dword [ebp - 0x6a2319c3], 0xffffff9e
jnp 0x42a1be
jb 0x42a183
stosb byte es:[edi], al
sub byte [edi - 0x3b8f74ed], cl
and edi, dword [edx - 5]
stc
daa
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004253f2
xor eax, eax
inc eax
call fcn.0043a1af
ret
Function at 0x42a886
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x62c144]
Function at 0x42a9bb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00446360
add esp, 0xc
mov dword [ebp - 0x120], esi
call fcn.0043d708
test al, al
je 0x42aa08
int1
invalid
call fcn.0043d411
test al, al
je 0x42aa30
adc al, al
and edx, dword [edx]
int3
call fcn.0043d22e
test al, al
je 0x42aa4f
les esp, [eax + 0x77db9c62]
and dword [edx + eax*8 - 0x59], eax
test dl, cl
dec eax
int1
push ss
salc
inc ecx
sbb dword [edx], esi
invalid
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x42aa73
cmp dword [ebp - 0x118], 2
jb 0x42aa73
xor eax, eax
inc eax
jmp 0x42aac8
call fcn.0043d411
test al, al
je 0x42aa97
iretd
call fcn.0043d2b8
test al, al
je 0x42aabe
dec edx
invalid
cmp dword [ebp - 0x11c], 0xa
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret

Function at 0x42aad9
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00446360
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0043d5f4
test al, al
je 0x42ab4c
add byte [eax + eax*8 - 0x4dece28c], al
shl dword [ecx + 0x78d11e7], 0x87
adc esi, dword [edx + 0x11e7a1c1]
lea eax, [edi]
xchg dword [edi], ecx
dec esp
jns 0x42ab2a
cmovl edi, dword [ecx - 0x12]
mov esi, 0x5ec869aa
mov edx, 0x5c327740
mov bl, 0x4f
xchg ebp, ebp
mov esi, 0x2bb7e810
add dword [eax], eax
call fcn.0043d708
test al, al
je 0x42ab73
xchg esi, eax
js 0x42abb1
invalid
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.0043d2b8
test al, al
je 0x42aba7
div dword [eax]
in eax, 0x4c
push ebx
sti
jne 0x42ab38
mov ebp, 0x294c3586
dec ebx
out dx, eax
mov bl, 0xe2
add edi, edx
mov dl, byte [edi]
push 0x342eccbe
add byte [edx - 0x7ccca563], 0xff
add eax, 0xfe830a7f
add bh, byte [edi + 5]
cmp edi, 5
jg 0x42abb6
cmp esi, 2
jg 0x42abb6
xor eax, eax
inc eax
jmp 0x42abb8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret