joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [0x518638]
push ebp
xor ebp, ebp
test eax, eax
jne 0x426df3
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, 0x77
mov word [esp + 0x1a], ax
mov ecx, 0x2e
mov word [esp + 0x22], cx
mov eax, 0x61
mov word [esp + 0x1c], ax
mov edx, 0x6c
mov word [esp + 0x18], dx
mov ecx, 0x73
xor edx, edx
mov eax, 0x6c
mov word [esp + 0x14], cx
mov ecx, eax
mov word [esp + 0x26], ax
mov word [esp + 0x2a], dx
mov eax, 0x70
mov edx, 0x69
mov word [esp + 0x1e], ax
mov word [esp + 0x28], cx
mov word [esp + 0x20], dx
lea eax, [esp + 0x14]
mov ecx, 0x68
mov edx, 0x64
push eax
mov word [esp + 0x1a], cx
mov word [esp + 0x28], dx
call fcn.004097c0
test eax, eax
je 0x426dea
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov word [esp + 0x10], cx
mov byte [esp + 0x12], cl
mov byte [esp + 0x12], cl
mov cl, 0x74
mov byte [esp + 0xa], cl
mov byte [esp + 6], cl
lea ecx, [esp + 4]
mov dl, 0x63
push ecx
push eax
mov byte [esp + 0x13], dl
mov byte [esp + 0x10], 0x4d
mov byte [esp + 0x17], 0x65
mov byte [esp + 0x11], 0x61
mov byte [esp + 0xc], 0x50
mov byte [esp + 0xf], 0x68
mov byte [esp + 0x14], 0x68
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x57
mov byte [esp + 0xd], 0x61
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x16], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x518638], eax
jmp 0x426def
mov eax, dword [0x518638]
test eax, eax
je 0x426e07
push edi
push esi
call eax
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00471eba
add esp, 0x2c
ret
mov ecx, dword [esp + 0x2c]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00471eba
add esp, 0x2c
ret
Function at 0x427380
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1e0
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x1dc], eax
push ebx
mov ebx, dword [esp + 0x1e8]
mov eax, dword [ebx]
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
cmp eax, 0xffffffff
je 0x427455
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x427455
mov edx, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea eax, [esp + 0x18]
push eax
push 0x118
lea ecx, [esp + 0x24]
push ecx
push edx
call ebp
test eax, eax
je 0x427455
cmp dword [esp + 0x18], 0x54444851
jne 0x427455
cmp dword [esp + 0x1c], 0x118
ja 0x427455
mov edx, dword [ebx]
push 0
lea eax, [esp + 0x18]
push eax
lea edi, [ebx + 0xb8]
mov ecx, 0x46
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push 0xb4
lea ecx, [esp + 0x13c]
push ecx
push edx
call ebp
test eax, eax
je 0x427455
lea eax, [esp + 0x130]
push eax
mov ecx, ebx
call fcn.00427480
test eax, eax
je 0x427455
mov edi, ebx
call fcn.00427550
test eax, eax
je 0x427455
mov eax, 1
mov dword [ebx + 0x3dc], eax
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1ec]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00471eba
add esp, 0x1e0
ret 4

Function at 0x427480
Capabilities:
Get file size

Disassembly:
sub esp, 0xc0
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xc4]
push esi
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x3e0]
lea edi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0041e970
add esp, 8
cmp dword [esp + 0xc], 0x74
jne 0x42752d
lea edx, [esp + 0x20]
push str.www.360.cn
push edx
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x42752d
mov ecx, dword [esi]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x42752d
cmp dword [esp + 8], 0
jne 0x42752d
cmp eax, dword [esp + 0x70]
jne 0x42752d
lea edx, [esi + 0x1d0]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x42752d
lea edi, [esi + 4]
mov ecx, 0x2d
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
jmp 0x42752f
xor eax, eax
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
xor ecx, esp
call fcn.00471eba
add esp, 0xc0
ret 4
Function at 0x427550
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x84
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x7c], eax
mov eax, dword [edi]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x427697
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x427697
mov ecx, dword [edi]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x427697
cmp dword [esp + 0xc], ebx
jne 0x427697
push 0x512dc0
push esi
call fcn.00472b75
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x42767f
mov eax, dword [edi]
push 0
lea edx, [esp + 0x18]
push edx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42765c
push 0xb4
lea ecx, [ebx + 0x118]
push 0
push ecx
call fcn.00476ef0
lea eax, [esp + 0x24]
call fcn.0041d6e0
push ebx
mov eax, esi
lea ecx, [esp + 0x28]
call fcn.0041ddf0
add esp, 0x10
lea esi, [esp + 0x18]
lea ecx, [esp + 0x74]
call fcn.0041de90
lea eax, [edi + 4]
lea edx, [esp + 0x74]
mov ecx, 0x10
sub edx, eax
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x42765c
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x427626
push ebx
mov esi, 1
call fcn.00472eb2
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.00471eba
add esp, 0x84
ret
mov esi, dword [esp + 0x10]
push ebx
call fcn.00472eb2
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.00471eba
add esp, 0x84
ret
mov eax, dword [esp + 0x10]
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.00471eba
add esp, 0x84
ret
mov ecx, dword [esp + 0x84]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00471eba
add esp, 0x84
ret
Function at 0x4276b0
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [esp + 0x130]
push ebx
mov dword [esp + 8], eax
mov eax, dword [esi + 0x3d8]
push ebp
push edi
test eax, eax
jne 0x4278d0
mov al, 0x6d
mov byte [esp + 0x120], al
mov byte [esp + 0x12d], al
mov byte [esp + 0x133], al
mov eax, dword [esi]
xor edi, edi
mov bl, 0xb1
mov dl, 0x68
mov cl, 0x8d
mov dword [esp + 0x14], edi
mov byte [esp + 0x114], 0x3a
mov byte [esp + 0x115], 0x48
mov byte [esp + 0x116], 0x6b
mov byte [esp + 0x117], 0xa2
mov byte [esp + 0x118], 0x57
mov byte [esp + 0x119], 0x27
mov byte [esp + 0x11a], bl
mov byte [esp + 0x11b], 0x80
mov byte [esp + 0x11c], 0xd
mov byte [esp + 0x11d], 0x50
mov byte [esp + 0x11e], dl
mov byte [esp + 0x11f], cl
mov byte [esp + 0x121], 0x72
mov byte [esp + 0x122], 0xb
mov byte [esp + 0x123], 0xe2
mov byte [esp + 0x124], 0xc6
mov byte [esp + 0x125], 0x78
mov byte [esp + 0x126], 0xff
mov byte [esp + 0x127], 0x31
mov byte [esp + 0x128], 0x22
mov byte [esp + 0x129], 0xcb
mov byte [esp + 0x12a], 0x44
mov byte [esp + 0x12b], 0x63
mov byte [esp + 0x12c], bl
mov byte [esp + 0x12e], 0x1b
mov byte [esp + 0x12f], 0x95
mov byte [esp + 0x130], 0xf5
mov byte [esp + 0x131], dl
mov byte [esp + 0x132], cl
cmp eax, 0xffffffff
je 0x4278ce
cmp dword [esi + 0x3dc], edi
je 0x4278ce
push edi
push edi
push 0x1cc
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4278ce
mov ecx, dword [esi + 0x68]
push 0x512dc0
push ecx
call fcn.00472b75
mov edx, dword [esi + 0x68]
add edx, 0x20
push 0x512dc0
push edx
mov ebx, eax
call fcn.00472b75
add esp, 0x10
mov ebp, eax
test ebx, ebx
je 0x4278b0
test ebp, ebp
je 0x4278bd
mov ecx, dword [esi + 0x64]
mov edx, dword [esi]
push edi
lea eax, [esp + 0x18]
push eax
sub ecx, 0x1cc
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4278b0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x118]
call fcn.0041b920
mov edx, dword [esi + 0x68]
add esp, 4
lea ecx, [esp + 0x18]
push ecx
push edx
push ebx
lea edi, [esp + 0x130]
mov ecx, ebp
call fcn.0041c890
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x3d8], ebx
mov edi, ebx
test eax, eax
je 0x4278a3
mov ecx, dword [esi + 0x68]
mov dword [eax], ecx
push ebp
call fcn.00472eb2
add esp, 4
mov eax, edi
jmp 0x4278d0
test ebp, ebp
je 0x4278bd
push ebp
call fcn.00472eb2
add esp, 4
test ebx, ebx
je 0x4278ac
push ebx
call fcn.00472eb2
add esp, 4
mov eax, edi
jmp 0x4278d0
xor eax, eax
mov ecx, dword [esp + 0x134]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00471eba
add esp, 0x12c
ret 4
Function at 0x42a2c0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x499e33
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x3c]
mov ecx, dword [0x517d88]
sub ecx, dword [0x517d84]
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
xor edi, edi
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x1c], edi
je 0x42a3e4
cmp dword [esp + 0x38], edi
je 0x42a3e4
test ebx, ebx
je 0x42a3e4
cmp dword [esp + 0x40], edi
je 0x42a3e4
cmp dword [esp + 0x44], edi
je 0x42a3e4
xor ebp, ebp
test eax, eax
jbe 0x42a3e4
mov esi, ebp
call fcn.0042b510
cmp dword [eax + 4], 0
jne 0x42a3be
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.004087d0
mov dword [esp + 0x30], 0
lea edi, [esp + 0x18]
call fcn.0042af20
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x42a384
push 0x4a7ce8
push eax
call fcn.00475d71
add esp, 8
mov esi, ebp
call fcn.0042b510
add eax, 8
cmp dword [eax + 0x18], 8
jb 0x42a399
mov eax, dword [eax + 4]
jmp 0x42a39c
add eax, 4
mov edi, eax
mov esi, ebx
call fcn.00426cc0
test eax, eax
jne 0x42a3fa
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00404e20
mov edi, dword [esp + 0x1c]
mov ecx, dword [0x517d88]
sub ecx, dword [0x517d84]
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
inc ebp
add ecx, edx
cmp ebp, ecx
jb 0x42a344
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push 0x238
call fcn.0047235a
add esp, 4
mov dword [esp + 0x20], eax
mov byte [esp + 0x30], 1
test eax, eax
je 0x42a41e
push eax
call fcn.0042a510
mov edi, eax
jmp 0x42a420
xor edi, edi
mov byte [esp + 0x30], 0
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov esi, ebp
mov dword [edi], edx
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
call fcn.0042b510
mov edx, dword [eax + 0x24]
mov dword [edi + 0x214], edx
call fcn.0042b510
mov eax, dword [eax + 0x28]
mov dword [edi + 0x218], eax
lea eax, [edi + 0xc]
mov edx, ebx
mov esi, 0x104
sub edx, eax
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x42a483
movzx ecx, word [edx + eax]
test cx, cx
je 0x42a483
mov word [eax], cx
add eax, 2
sub esi, 1
jne 0x42a463
jmp 0x42a487
test esi, esi
jne 0x42a48a
sub eax, 2
xor edx, edx
mov esi, ebp
mov word [eax], dx
call fcn.0042b510
mov esi, eax
add esi, 0x2c
lea eax, [edi + 0x220]
call fcn.0042af80
mov esi, ebp
call fcn.0042b510
mov eax, dword [eax + 4]
lea ecx, [esp + 0x24]
push ecx
push 0
push edi
push 0x42aae0
push 0
push 0
mov dword [edi + 0x21c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42a4df
push eax
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42a4e9
push edi
call fcn.0042a560
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00404e20
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x42ab20
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push esi
lea eax, [esp + 8]
xor ebx, ebx
push eax
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x42abb7
push ebp
push esi
call fcn.00472de8
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x42abae
mov ecx, dword [esp + 0xc]
push ebp
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42aba5
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x4a5a68
push ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42aba5
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x42aba5
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x42ab93
mov edx, dword [eax + 8]
mov dword [ecx], edx
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x42aba0
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
mov ebx, 1
push ebp
call fcn.00472c50
add esp, 4
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret

Function at 0x42ace0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x49934f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x24], 0
push 0x24
mov dword [esp + 0x10], 0
call fcn.0047235a
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], 1
test eax, eax
je 0x42ad36
push eax
call fcn.0042add0
mov edi, eax
jmp 0x42ad38
xor edi, edi
mov byte [esp + 0x24], 0
test edi, edi
je 0x42ad9f
mov eax, dword [esp + 0x2c]
lea esi, [edi + 4]
lea ecx, [esp + 0x30]
mov dword [edi], eax
cmp esi, ecx
je 0x42ad75
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea edx, [esp + 0x20]
push edx
mov eax, esi
call fcn.0042b840
lea eax, [esp + 0x30]
push eax
mov eax, esi
call fcn.0042b920
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
push 0x42abc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42ad99
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42ad9f
push edi
call fcn.0042ae20
mov dword [esp + 0x24], 0xffffffff
lea edx, [esp + 0x30]
push edx
call fcn.0042b230
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x42ae80
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 8
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esp + 0x10], eax
jbe 0x42af06
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x18]
push ebx
push esi
mov dword [esp + 0xc], eax
neg ebp
push edi
xor esi, esi
cmp dword [esp + 0x28], esi
jbe 0x42aee6
lea esp, [esp]
mov ecx, dword [esp + 0x24]
lea ebx, [esi + ecx]
lea edx, [ebx + ebp]
cmp edx, dword [esp + 0x20]
jae 0x42aee6
mov eax, dword [esp + 0x10]
lea edi, [eax + esi]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x42af00
mov bl, byte [ebx]
cmp byte [edi], bl
je 0x42aedf
cmp bl, 0xcc
jne 0x42aee6
inc esi
cmp esi, dword [esp + 0x28]
jb 0x42aeb0
cmp esi, dword [esp + 0x28]
je 0x42af0a
mov eax, dword [esp + 0x14]
inc dword [esp + 0x10]
inc eax
inc ebp
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x20]
jb 0x42aea1
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 8
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
lea eax, [ecx + edx]
pop ebp
add esp, 8
ret
Function at 0x42da90
Capabilities:
Enumerate threads

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x1c
push ebx
push ebp
push edi
push eax
push 4
xor ebp, ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42dbe4
test ebx, ebx
je 0x42dbe4
xor eax, eax
push esi
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], eax
mov edi, 0x1c
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], edi
xor esi, esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x42dbc4
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x1c], edx
jne 0x42daff
inc esi
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x42daf4
test esi, esi
je 0x42dbc4
add esi, esi
add esi, esi
push esi
call fcn.00472de8
mov edi, dword [esp + 0x34]
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x42dbc8
push esi
push 0
push eax
call fcn.00476ef0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push ebx
xor esi, esi
mov dword [esp + 0x18], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x42dbba
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x1c], edx
jne 0x42dba3
mov eax, dword [esp + 0x18]
push eax
push 0
push 0xa
call ebp
cmp eax, 0xffffffff
je 0x42db8c
mov ecx, dword [esp + 0x38]
push ecx
mov edi, eax
call fcn.0042dc50
mov edi, dword [esp + 0x30]
jmp 0x42db8f
or eax, 0xffffffff
mov edx, dword [edi]
mov dword [edx + esi*4], eax
mov eax, dword [edi]
mov eax, dword [eax + esi*4]
cmp eax, 0xffffffff
je 0x42dba3
test eax, eax
je 0x42dba3
inc esi
lea ecx, [esp + 0x10]
push ecx
push ebx
mov dword [esp + 0x18], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x42db60
mov dword [edi + 4], esi
mov ebp, 1
jmp 0x42dbc8
mov edi, dword [esp + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
test ebp, ebp
jne 0x42dbed
call fcn.0042dc00
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
mov edi, dword [esp + 0x2c]
call fcn.0042dc00
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x42dc00
Capabilities:
Resume thread

Disassembly:
push esi
xor esi, esi
cmp dword [edi + 4], esi
jbe 0x42dc2e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
mov ecx, dword [eax + esi*4]
push ecx
call ebx
mov edx, dword [edi]
mov eax, dword [edx + esi*4]
push eax
call ebp
inc esi
cmp esi, dword [edi + 4]
jb 0x42dc16
pop ebp
pop ebx
mov ecx, dword [edi]
push ecx
call fcn.00472c50
add esp, 4
mov dword [edi], 0
mov dword [edi + 4], 0
pop esi
ret
Function at 0x42dc50
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 0x2d8
push ebp
xor ebp, ebp
cmp edi, ebp
je 0x42dd5c
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x42dd49
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x10001
mov dword [esp + 0xc], ebp
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x42dd5c
mov ecx, dword [esp + 0x2e0]
add ecx, 0x2014
push ebx
mov dword [esp + 0xc], ecx
push esi
jmp 0x42dcb0
mov edx, dword [esp + 0xd0]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x14], edx
xor ebx, ebx
mov eax, dword [esi]
test eax, eax
je 0x42dd0f
cmp dword [esi + 4], 0
je 0x42dd0f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42dd0f
cmp edx, eax
jb 0x42dd06
add ecx, eax
cmp edx, ecx
jae 0x42dd06
push edi
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebp, 3
jge 0x42dd34
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x14]
inc ebp
inc ebx
sub esi, 0xffffff80
cmp ebx, 2
jb 0x42dcc1
cmp dword [esp + 0xc], 0
je 0x42dd26
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x42dcb0
pop esi
pop ebx
mov eax, edi
pop ebp
add esp, 0x2d8
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0x2d8
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebp
add esp, 0x2d8
ret 4
mov eax, edi
pop ebp
add esp, 0x2d8
ret 4
Function at 0x430310
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x150
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x14c], eax
mov eax, dword [esp + 0x154]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43036f
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0xc], 0
je 0x430388
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.00471eba
add esp, 0x150
ret
test eax, eax
je 0x430368
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x40
lea edx, [esp + 0x11c]
push edx
push esi
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x430368
mov eax, 0x5a4d
cmp word [esp + 0x110], ax
jne 0x430368
mov edx, dword [esp + 0x14c]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x430368
push 0
lea eax, [esp + 0x14]
push eax
push 0xf8
lea ecx, [esp + 0x24]
push ecx
push esi
call edi
test eax, eax
je 0x430368
cmp dword [esp + 0x18], 0x4550
push esi
jne 0x430369
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x154]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00471eba
add esp, 0x150
ret

Function at 0x430440
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
push ebx
mov dword [esp + 0x18], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
jne 0x43046a
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push edi
push esi
call fcn.00472de8
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x430484
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push edi
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4304cd
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4a5a68
push edi
mov dword [esp + 0x20], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4304cd
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4304cd
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x24]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov ebp, 1
push edi
call fcn.00472c50
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret