joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406cd0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4436e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [0x45581c]
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
mov esi, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, eax
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [0x455830]
sar edx, 4
imul eax, eax, 0x35
mov ecx, edx
sub edi, esi
add edi, edx
mov edx, dword [0x455838]
imul edx, edx, 0xd
shr ecx, 0x1f
add ecx, edi
add ecx, edx
mov edx, dword [0x56bb8c]
add ecx, eax
mov dword [str._r_____r____], ecx
mov ecx, 0x56bb8c
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x45582c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x455818]
lea edx, [eax + eax*8]
shl edx, 3
mov esi, edx
sub esi, ecx
mov ecx, dword [0x455820]
mov eax, 0x66666667
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 4
imul ecx, ecx, 0x38
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [0x455834]
add esi, ecx
sub esi, eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
sub esi, 0x31
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [0x455820], esi
call fcn.00406a40
mov esi, dword [0x45582c]
mov ecx, dword [0x455820]
imul esi, esi, 0x31
mov eax, 0x92492493
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45581c]
mov eax, 0x38e38e39
imul ecx
mov esi, dword [esp + 8]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x22
sub edi, ecx
add edi, edx
push esi
mov dword [0x45582c], edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x406e5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40cf70
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
mov ecx, dword [0x45581c]
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebp
push esi
mov esi, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, eax
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [0x455830]
sar edx, 4
imul eax, eax, 0x35
sub edi, esi
add edi, edx
mov ecx, edx
mov edx, dword [0x455838]
imul edx, edx, 0xd
shr ecx, 0x1f
add ecx, edi
mov edi, dword [esp + 0x1c]
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push edi
mov dword [esp + 0x18], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
je 0x40d18e
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
push ebx
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [str._r_____r____]
add eax, ebx
sub eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x35
add eax, ecx
sub eax, edx
add eax, 0x28
push esi
mov dword [0x45581c], eax
call fcn.0043aad2
add esp, 4
mov ebx, eax
push ebx
push esi
xor esi, esi
push esi
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40d184
mov eax, dword [0x455828]
mov ecx, dword [0x45582c]
lea edx, [eax + eax*8]
shl edx, 3
mov edi, edx
mov eax, 0x4bda12f7
imul ecx
mov ecx, dword [0x455818]
sar edx, 4
imul ecx, ecx, 0x35
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, dword [0x455830]
mov edx, dword [str._r_____r____]
imul edx, edx, 0x36
sub edi, eax
add ecx, edi
lea eax, [edx + ecx - 0x31]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4461f4
push ebx
mov dword [0x455824], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40d132
mov ecx, dword [0x455828]
mov eax, dword [0x455818]
mov esi, dword [0x455834]
lea edi, [ecx + eax]
mov eax, 0x92492493
imul edi, edi, 0x36
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x10]
sub edi, ecx
mov dword [0x455834], edi
mov bp, word [edx + 0x14]
mov ecx, dword [0x455820]
mov eax, 0x92492493
imul ecx
mov eax, dword [0x45582c]
add edx, ecx
imul ecx, ecx, 0x32
imul eax, eax, 0x31
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x45581c]
add esi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x22
sub esi, ecx
add esi, edx
mov dword [0x45582c], esi
push ebx
call fcn.0043aad7
add esp, 4
pop ebx
pop edi
pop esi
mov ax, bp
pop ebp
add esp, 0xc
ret
Function at 0x416780
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x457190]
mov edx, dword [esp + 0x11c]
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x128], eax
mov eax, dword [ebp]
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4168a2
lea ecx, [esp + 8]
call fcn.00416660
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x4168a6
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x416850
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.00416780
mov edi, eax
test edi, edi
jne 0x4168ca
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x416812
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x416869
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x128]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x416888
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.00428e41
add esp, 0x118
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x4168b1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.00428e41
add esp, 0x118
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4168d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebp
call fcn.00428e41
add esp, 0x118
ret 4
Function at 0x416db0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x416dc2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x41a580
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x455824]
mov eax, 0x51eb851f
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov ebp, dword [0x455830]
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov esi, eax
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [esp + 0x18]
mov ebx, ebp
imul ebx, ebx, 0x35
mov edi, dword [0x455838]
imul edi, edi, 0xd
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esi, ebx
add ecx, esi
add ecx, edi
cmp eax, 0x132b600
mov dword [str._r_____r____], ecx
je 0x41a612
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x41a600
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, 0x38e38e39
imul ebp, ebp, 0x32
imul dword [0x455834]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x78787879
imul dword [0x455820]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov dword [esp + 0x18], eax
mov eax, 0x5397829d
imul dword [0x455834]
mov eax, dword [esp + 0x18]
sar edx, 4
add eax, edx
mov esi, edx
mov edx, dword [0x455818]
imul edx, edx, 0x31
shr esi, 0x1f
add esi, eax
mov eax, dword [0x56964c]
add esi, edx
sub esi, ebp
mov edx, eax
inc eax
test edx, edx
mov dword [0x455818], esi
mov dword [0x56964c], eax
jle 0x41a6cb
mov eax, 0x4bda12f7
imul dword [0x455838]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x4bda12f7
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, edi
pop edi
sub eax, ecx
pop esi
lea ecx, [eax + ebx + 0x28]
pop ebp
mov dword [0x45581c], ecx
mov eax, 1
pop ebx
pop ecx
ret
mov edi, dword [0x45582c]
imul ecx, ecx, 0x38
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x99999999
imul dword [0x455820]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, dword [0x455834]
lea edx, [esi + esi*8]
lea eax, [eax + edx*8]
add eax, ecx
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x41a0c0
sub eax, edi
push 0
sub eax, 0x31
push 0
mov dword [0x56936c], 0
mov dword [0x455820], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x455828]
mov ecx, dword [0x45582c]
lea edx, [eax + eax*8]
shl edx, 3
mov esi, edx
mov eax, 0x4bda12f7
imul ecx
mov ecx, dword [0x455818]
sar edx, 4
imul ecx, ecx, 0x35
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, dword [0x455830]
mov edx, dword [str._r_____r____]
imul edx, edx, 0x36
sub esi, eax
pop edi
add ecx, esi
pop esi
lea eax, [edx + ecx - 0x31]
pop ebp
mov dword [0x455824], eax
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x41eba0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [0x455824]
mov eax, 0x4bda12f7
imul ebx
sar edx, 4
push ebp
mov ebp, dword [0x45581c]
push esi
mov esi, dword [0x455838]
push edi
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x4d4873ed
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
imul ecx, ecx, 0xffffffcf
sub ecx, eax
mov edx, ebp
imul edx, edx, 0x36
add ecx, edx
mov eax, 0x4ec4ec4f
imul esi
mov eax, ecx
sar edx, 2
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, edi
cmp eax, 0x132b600
mov dword [0x455828], ecx
mov eax, 0x92492493
je 0x41ec6a
mov ecx, dword [0x455830]
imul ebx
imul esi, esi, 0xd
imul ecx, ecx, 0x35
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x51eb851f
imul ebp
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esi, ecx
mov dword [str._r_____r____], esi
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x41ec58
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov esi, dword [0x455820]
imul esi
mov eax, dword [0x455830]
add edx, esi
imul eax, eax, 0x22
imul esi, esi, 0x32
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45582c]
imul edx, edx, 0x31
add edi, esi
add edi, edx
add edi, eax
mov eax, 0x38e38e39
imul ebp
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x569360]
test eax, eax
mov dword [0x45582c], edi
jne 0x41ed7e
mov edx, dword [0x455818]
mov esi, dword [0x455834]
lea edi, [edx + ecx]
mov eax, 0x92492493
imul edi, edi, 0x36
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x41d7c0
push 0
sub edi, ecx
push 0
mov dword [0x455834], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x45582c]
mov esi, dword [0x455818]
mov dword [0x569350], eax
imul esi, esi, 0x35
mov eax, 0x4bda12f7
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 4
imul ecx, ecx, 0x36
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455830]
sub esi, eax
mov eax, dword [0x455828]
add ecx, edx
lea edx, [eax + eax*8]
add ecx, esi
lea eax, [ecx + edx*8 - 0x31]
mov dword [0x569360], 1
mov dword [0x455824], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x42001e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x420071
call fcn.00440ba5
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x420071
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x420067
xor eax, eax
jmp 0x42018a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x4200a1
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4200a1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x420187
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x4200ce
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0041f293
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x420187
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x420117
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x420117
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x420111
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0041f293
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x420177
and dword [ebp + 0xc], 0
jmp 0x420177
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x420177
push 0xc
call fcn.0043aaa7
mov esi, eax
test esi, esi
pop ecx
je 0x420159
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x42015b
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x420172
push dword [ebp - 8]
call fcn.004364fa
jmp 0x420177
call fcn.004364d1
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x4200dc
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4293ad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4293cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042b61c
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4293f0
test byte [esp + 8], 2
je 0x4293f0
call fcn.0042b60a
mov dword [eax], 0xd
call fcn.0042b613
mov dword [eax], 5
jmp 0x4293c9
xor eax, eax
ret
Function at 0x4294b7
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4495d0
call fcn.0042b488
push 8
call fcn.0042d6c1
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x56b67c], esi
jne 0x4294eb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x56b678], esi
mov al, byte [ebp + 0x10]
mov byte [0x56b674], al
cmp dword [ebp + 0xc], edi
jne 0x429535
cmp dword [0x56cf6c], edi
je 0x429525
mov eax, dword [0x56cf68]
sub eax, 4
mov dword [0x56cf68], eax
cmp eax, dword [0x56cf6c]
jb 0x429525
mov eax, dword [eax]
cmp eax, edi
je 0x429506
call eax
jmp 0x429506
push 0x4520cc
mov eax, 0x4520c4
call fcn.00429435
pop ecx
push 0x4520d8
mov eax, 0x4520d0
call fcn.00429435
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x429566
cmp dword [ebp + 0x10], edi
jne 0x429574
mov dword [0x56b67c], esi
push dword [ebp + 8]
call fcn.004293f3
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x429573
push 8
call fcn.0042d60c
pop ecx
ret
call fcn.0042b4c3
ret

Function at 0x4297e7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00429680
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x429882
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x56b63c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x429882
cmp eax, 1
je 0x4298a3
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x429882
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x42984f
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x42987e
xor eax, eax
inc eax
jmp 0x4298c2
cmp edi, eax
jae 0x429886
xor eax, eax
jmp 0x4298c2
cmp eax, esi
jae 0x42988d
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x56b63c]
jmp 0x4298a6
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42a242
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x449688
call fcn.0042b488
mov edi, 0x94
mov eax, edi
call fcn.00429680
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x56b63c], ecx
mov eax, dword [esi + 4]
mov dword [0x56b648], eax
mov edx, dword [esi + 8]
mov dword [0x56b64c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x56b640], esi
cmp ecx, 2
je 0x42a2a2
or esi, 0x8000
mov dword [0x56b640], esi
shl eax, 8
add eax, edx
mov dword [0x56b644], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x42a2dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42a2dd
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x42a2f5
cmp eax, 0x20b
je 0x42a2e2
mov dword [ebp - 0x1c], esi
jmp 0x42a309
cmp dword [ecx + 0x84], 0xe
jbe 0x42a2dd
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x42a303
cmp dword [ecx + 0x74], 0xe
jbe 0x42a2dd
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0042d802
pop ecx
test eax, eax
jne 0x42a31d
push 0x1c
call fcn.0042a21e
pop ecx
call fcn.0042c63d
test eax, eax
jne 0x42a32e
push 0x10
call fcn.0042a21e
pop ecx
call fcn.0042d6f2
mov dword [ebp - 4], esi
call fcn.004303cf
test eax, eax
jge 0x42a347
push 0x1b
call fcn.0042a1f9
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x56cf60], eax
call fcn.004302ad
mov dword [0x56b688], eax
call fcn.0043020b
test eax, eax
jge 0x42a36d
push 8
call fcn.0042a1f9
pop ecx
call fcn.0042ffd8
test eax, eax
jge 0x42a37e
push 9
call fcn.0042a1f9
pop ecx
push 1
call fcn.0042944d
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x42a394
push eax
call fcn.0042a1f9
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0042ff7b
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x42a3b5
movzx eax, word [ebp - 0x40]
jmp 0x42a3b8
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00435b9e
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x42a3d6
push edi
call fcn.0042957a
call fcn.0042959c
jmp 0x42a408
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0042b4c3
ret
Function at 0x42e391
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x42e3bf
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x42e3c6
cmp ebx, dword [eax + 4]
jae 0x42e3c6
xor eax, eax
jmp 0x42e5b6
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x42e3d7
xor eax, eax
inc eax
jmp 0x42e5b5
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x42e3ed
cmp ecx, edx
jae 0x42e532
cmp dword [eax + 4], 0
je 0x42e3f6
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x42e3de
cmp dword [ebp + 8], 0
je 0x42e418
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x42e532
cmp eax, esi
jae 0x42e532
mov eax, dword [0x56b818]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x42e43d
cmp dword [esi*4 + 0x56b820], edi
je 0x42e536
inc esi
cmp esi, eax
jl 0x42e42b
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42e5b2
cmp dword [ebp - 8], 0x1000000
jne 0x42e5b2
test byte [ebp - 0xc], 0xcc
je 0x42e4bb
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x42e5b2
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x42e5b2
cmp word [eax + 0x18], 0x10b
jne 0x42e5b2
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x42e5b2
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x42e4bb
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x42e4bb
test byte [ecx + 0x27], 0x80
jne 0x42e532
push 1
push 0x56b860
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x42e3cf
mov ecx, dword [0x56b818]
test ecx, ecx
mov edx, ecx
jle 0x42e4ef
lea eax, [ecx*4 + 0x56b81c]
cmp dword [eax], edi
je 0x42e4ef
dec edx
sub eax, 4
test edx, edx
jg 0x42e4e3
test edx, edx
jne 0x42e520
push 0xf
pop ebx
cmp ecx, ebx
jg 0x42e4fc
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x42e514
lea eax, [edx*4 + 0x56b820]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x42e502
cmp ecx, 0x10
jge 0x42e520
inc ecx
mov dword [0x56b818], ecx
push 0
push 0x56b860
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x42e3cf
xor eax, eax
jmp 0x42e5b5
test esi, esi
jle 0x42e3cf
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x56b860
call ebx
test eax, eax
jne 0x42e3cf
cmp dword [esi*4 + 0x56b820], edi
je 0x42e58c
mov eax, dword [0x56b818]
lea esi, [eax - 1]
test esi, esi
jl 0x42e57a
cmp dword [esi*4 + 0x56b820], edi
je 0x42e576
dec esi
jns 0x42e56a
test esi, esi
jge 0x42e58a
cmp eax, 0x10
jge 0x42e585
inc eax
mov dword [0x56b818], eax
lea esi, [eax - 1]
jmp 0x42e58c
je 0x42e5a4
xor ecx, ecx
test esi, esi
jl 0x42e5a4
lea eax, [ecx*4 + 0x56b820]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x42e592
push 0
push 0x56b860
call ebx
jmp 0x42e3cf
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret