joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429191
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push str.SystemCurrentControlSetServices_s
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.0040a2c0
add esp, 0x10
lea edx, [ebp - 0x104]
push edx
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
neg eax
sbb eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x429272
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push edi
mov dword [ebp - 8], 0
push 0x4d66b4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
push 0x4d66c0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
push 0x4d66d0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x4d66e0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push 0x4d6700
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
push 0x4d6714
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push 0x4d672c
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], 0
je 0x4293d9
cmp dword [ebp - 0xc], 0
je 0x4293d9
cmp dword [ebp - 4], 0
je 0x4293d9
cmp dword [ebp - 0x20], 0
je 0x4293d9
cmp dword [ebp - 0x10], 0
je 0x4293d9
cmp dword [ebp - 0x1c], 0
je 0x4293d9
mov byte [ebp - 0x124], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push 0x4d6744
push 0x104
lea ecx, [ebp - 0x124]
push ecx
call fcn.0040a2c0
add esp, 0x10
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x20]
push 1
lea ecx, [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x134]
push edx
call dword [ebp - 4]
test eax, eax
jne 0x4293d9
lea eax, [ebp - 0x134]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x4293c8
cmp dword [ebp - 0x138], 0xc000010e
je 0x4293c8
cmp dword [ebp - 0x138], 0xc0000035
jne 0x4293cf
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x134]
push ecx
call dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4293e1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push edi
mov dword [ebp - 8], 0
push 0x4d677c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
push str.ZwLoadDriver
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
push str.ZwUnloadDriver
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x4d67a8
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push 0x4d67c8
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
push 0x4d67dc
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push 0x4d67f4
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], 0
je 0x429521
cmp dword [ebp - 0xc], 0
je 0x429521
cmp dword [ebp - 4], 0
je 0x429521
cmp dword [ebp - 0x20], 0
je 0x429521
cmp dword [ebp - 0x10], 0
je 0x429521
cmp dword [ebp - 0x1c], 0
je 0x429521
mov byte [ebp - 0x124], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push str.RegistryMachineSystemCurrentControlSetServices_s
push 0x104
lea ecx, [ebp - 0x124]
push ecx
call fcn.0040a2c0
add esp, 0x10
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x20]
push 1
lea ecx, [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x134]
push edx
call dword [ebp - 4]
test eax, eax
jne 0x429521
lea eax, [ebp - 0x134]
push eax
call dword [ebp - 0xc]
test eax, eax
jne 0x429517
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x134]
push ecx
call dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42a18e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x108], 1
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [ebp - 0x10c], dl
cmp byte [ebp - 0x10c], 0x31
je 0x42a1d2
cmp byte [ebp - 0x10c], 0x32
je 0x42a1f7
jmp 0x42a21c
mov eax, dword [ebp + 8]
add eax, 2
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x4d7cb4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040a2c0
add esp, 0x14
jmp 0x42a226
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
lea edx, [ebp - 0x104]
push edx
push str._s_system32_s
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040a2c0
add esp, 0x14
jmp 0x42a226
mov dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
mov esp, ebp
pop ebp
ret

Function at 0x42a230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab688
push 0x4a2bd4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x5a4d
je 0x42a286
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
jmp 0x42a2e2
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx], 0x4550
jne 0x42a2aa
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jne 0x42a2bd
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
jmp 0x42a2e2
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
jmp 0x42a2e2
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a3a6
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [0x5429a0]
push 0x80
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x5429a0]
push 1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x42a3f7
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [0x5429a0]
mov eax, 1
jmp 0x42a47c
mov edx, dword [ebp + 8]
push edx
push str._s.tmp2
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a2c0
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x104]
push ecx
call dword [0x5429a0]
lea edx, [ebp - 0x104]
push edx
call dword [0x542978]
push 1
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x42a473
push 4
push 0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x42a473
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x42a477
xor eax, eax
jmp 0x42a47c
mov eax, 2
mov esp, ebp
pop ebp
ret
Function at 0x42a480
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [0x5429a0]
mov ecx, dword [ebp + 8]
push ecx
call dword [0x542978]
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [ebp + 8]
push eax
call dword [0x542978]
pop ebp
ret

Function at 0x42a4b6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
cmp dword [ebp + 8], 0
je 0x42a4d1
cmp dword [ebp + 0x14], 0
je 0x42a4d1
cmp dword [ebp + 0x18], 0
jne 0x42a4d8
xor eax, eax
jmp 0x42a67e
push 0
push 0
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [0x545604]
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xffffffff
jne 0x42a507
xor eax, eax
jmp 0x42a67e
cmp dword [ebp + 0xc], 0
jne 0x42a516
lea ecx, [ebp - 0x13c]
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x10], 0
jne 0x42a525
lea edx, [ebp - 0xf8]
mov dword [ebp + 0x10], edx
push 0
lea eax, [ebp - 0x140]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xfc]
push edx
call dword [0x542984]
test eax, eax
je 0x42a66f
cmp dword [ebp - 0x140], 0x40
jne 0x42a66f
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
jne 0x42a66f
push 0
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp - 0xfc]
push ecx
call dword [0x5429a4]
mov edx, dword [ebp + 0xc]
cmp eax, dword [edx + 0x3c]
jne 0x42a66f
push 0
lea eax, [ebp - 0x140]
push eax
push 0xf8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xfc]
push edx
call dword [0x542984]
test eax, eax
je 0x42a66f
cmp dword [ebp - 0x140], 0xf8
jne 0x42a66f
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
jne 0x42a66f
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov dx, word [ecx + 6]
test edx, edx
je 0x42a66f
push 1
push 0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x14]
sub ecx, 0xe0
push ecx
mov edx, dword [ebp - 0xfc]
push edx
call dword [0x5429a4]
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp + 0x18], ecx
jbe 0x42a620
mov edx, dword [ebp + 0x10]
xor eax, eax
mov ax, word [edx + 6]
mov dword [ebp + 0x18], eax
mov ecx, dword [ebp + 0x18]
imul ecx, ecx, 0x28
mov dword [ebp - 0x144], ecx
push 0
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xfc]
push edx
call dword [0x542984]
test eax, eax
je 0x42a66f
mov eax, dword [ebp - 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x144]
xor edx, edx
mov ecx, 0x28
div ecx
jmp 0x42a67e
mov edx, dword [ebp - 0xfc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42ae0a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
cmp dword [ebp + 8], 0
je 0x42ae29
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x42ae2d
xor eax, eax
jmp 0x42aea5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x42ae3f
xor eax, eax
jmp 0x42aea5
mov edx, dword [ebp + 8]
push edx
call dword [0x5429b0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x42ae67
mov eax, dword [ebp - 8]
and eax, 0x10
test eax, eax
je 0x42ae60
xor eax, eax
jmp 0x42aea5
mov eax, 1
jmp 0x42aea5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x5429a8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42ae85
xor eax, eax
jmp 0x42aea5
mov eax, dword [ebp - 4]
push eax
call dword [0x542988]
mov ecx, dword [ebp - 0x148]
and ecx, 0x10
test ecx, ecx
je 0x42aea0
xor eax, eax
jmp 0x42aea5
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x42aecb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
movsx edx, byte [ecx]
test edx, edx
je 0x42afa2
push 0x5c
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x42af19
mov eax, 1
jmp 0x42afa7
mov ecx, dword [ebp - 0x108]
sub ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.0042aea9
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
cmp eax, 2
jne 0x42af6a
movsx edx, byte [ebp - 0x103]
cmp edx, 0x3a
jne 0x42af6a
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
jmp 0x42aedd
push 0
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x42af8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42af8e
xor eax, eax
jmp 0x42afa7
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
jmp 0x42aedd
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42afed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movsx eax, byte [0x545500]
test eax, eax
jne 0x42b04a
push 0x104
push 0x545500
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movsx ecx, byte [0x545500]
cmp ecx, 0x41
jl 0x42b02f
movsx edx, byte [0x545500]
cmp edx, 0x5a
jg 0x42b02f
mov dword [ebp - 4], 1
jmp 0x42b036
mov dword [ebp - 4], 0
movsx eax, byte [0x545500]
mov ecx, dword [ebp - 4]
shl ecx, 5
add eax, ecx
mov byte [0x545500], al
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3a
jne 0x42b09e
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x41
jl 0x42b075
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5a
jg 0x42b075
mov dword [ebp - 8], 1
jmp 0x42b07c
mov dword [ebp - 8], 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
mov ecx, dword [ebp - 8]
shl ecx, 5
add eax, ecx
movsx edx, byte [0x545500]
cmp eax, edx
jne 0x42b09e
mov dword [ebp - 0xc], 1
jmp 0x42b0a5
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42b0ac
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0x10], 0
je 0x42b0cf
mov dword [ebp - 0x10], SysStringLen
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], 4
jmp 0x42b0e4
mov dword [ebp - 0x10], 0xc0000000
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 6
push 0
push 0
push 3
push 0
push 1
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x42b16b
cmp dword [ebp + 0xc], 0
je 0x42b11c
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push 0
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x42b16b
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
jmp 0x42b16d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42b186
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x42b21e
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
push 4
push 0x1000
mov edx, dword [ebp - 8]
add edx, 0x100
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42b214
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [0x542984]
cmp dword [ebp + 0xc], 0
je 0x42b205
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x42b220
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42b565
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cx, word [eax + 6]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
xor eax, eax
mov ax, word [edx + 0x14]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0xc]
jae 0x42b5b0
mov eax, dword [ebp + 0xc]
jmp 0x42b635
mov dword [ebp - 0x14], 0
jmp 0x42b5c2
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jae 0x42b632
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x38]
push edx
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 8]
push edx
call fcn.0042b529
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0xc]
add edx, dword [ebp - 0x18]
cmp dword [ebp + 0xc], edx
jae 0x42b630
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
sub esi, dword [ecx + eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 0x14]
push eax
call fcn.0042b4f7
add esp, 8
add eax, esi
jmp 0x42b635
jmp 0x42b5b9
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42ba92
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
je 0x42bb85
push 0
push 0
push 3
push 0
push 3
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x40000000
add eax, 0x80000000
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x545604]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x42bad8
xor eax, eax
jmp 0x42bb87
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x14], 0
jne 0x42baf5
cmp dword [ebp - 8], 0
jne 0x42bb06
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42bb87
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
and edx, 2
add edx, 2
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x42bb3d
xor eax, eax
jmp 0x42bb87
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
and edx, 2
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
jne 0x42bb72
xor eax, eax
jmp 0x42bb87
cmp dword [ebp + 0xc], 0
je 0x42bb80
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
jmp 0x42bb87
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42c1e2
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x354], eax
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00409190
mov eax, dword [ebp - 0x354]
movsx ecx, byte [ebp + eax - 0x20d]
cmp ecx, 0x5c
je 0x42c26c
push 0x4d7d10
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00408090
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409190
push 0x4d7d14
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00408090
mov dword [ebp - 0x108], 1
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [0x5429a8]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x42c336
cmp dword [ebp - 0x108], 0
je 0x42c336
mov edx, dword [ebp - 0x350]
and edx, 0x10
test edx, edx
jne 0x42c31a
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409190
lea edx, [ebp - 0x324]
push edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00408090
lea ecx, [ebp - 0x104]
push ecx
call dword [0x542978]
lea edx, [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [0x542974]
mov dword [ebp - 0x108], eax
jmp 0x42c2be
cmp dword [ebp - 0x210], 0xffffffff
je 0x42c34c
mov ecx, dword [ebp - 0x210]
push ecx
call dword [0x542988]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42c35e
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x354], eax
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00409190
mov eax, dword [ebp - 0x354]
movsx ecx, byte [ebp + eax - 0x20d]
cmp ecx, 0x5c
je 0x42c3e8
push 0x4d7d18
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00408090
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409190
push 0x4d7d1c
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00408090
mov dword [ebp - 0x108], 1
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [0x5429a8]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x42c52a
cmp dword [ebp - 0x108], 0
je 0x42c52a
mov edx, dword [ebp - 0x350]
and edx, 0x10
test edx, edx
jne 0x42c4a0
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409190
lea edx, [ebp - 0x324]
push edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00408090
lea ecx, [ebp - 0x104]
push ecx
call dword [0x542978]
jmp 0x42c50b
lea edx, [ebp - 0x20c]
push edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00409190
lea ecx, [ebp - 0x324]
push ecx
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00408090
push 0x4d7d20
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x42c50b
push 0x4d7d24
lea ecx, [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x42c50b
lea edx, [ebp - 0x104]
push edx
call fcn.0042c35e
add esp, 4
lea eax, [ebp - 0x350]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call dword [0x542974]
mov dword [ebp - 0x108], eax
jmp 0x42c43a
cmp dword [ebp - 0x210], 0xffffffff
je 0x42c540
mov edx, dword [ebp - 0x210]
push edx
call dword [0x542988]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
mov esp, ebp
pop ebp
ret