joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100342a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x358], 0
push edi
push 0x1b0
push eax
mov dword [ebp - 0xc], eax
xor edi, edi
mov word [ebp - 8], ax
mov word [ebp - 0x35c], ax
mov byte [ebp - 0x35a], al
lea eax, [ebp - 0x354]
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.10108310
add esp, 0x24
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.kernel32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
je 0x100343be
push 0x10
call dword [sym.imp.kernel32.dll_GetUserGeoID]
push edi
push 3
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.kernel32.dll_GetGeoInfoW]
mov ebx, eax
lea eax, [ebp - 0x358]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x35c]
push 3
push eax
call fcn.10100856
lea eax, [ebp - 0x358]
push eax
push str.windowsZones
push edi
call fcn.10100856
mov esi, eax
lea eax, [ebp - 0x358]
push eax
push esi
push str.mapTimezones
push esi
call fcn.10100856
lea eax, [ebp - 0x358]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2a8]
push eax
push edi
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.10100856
add esp, 0x4c
cmp dword [ebp - 0x358], edi
jle 0x100343d1
test esi, esi
je 0x100343be
push esi
call fcn.10100856
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x2a8], di
je 0x100344b6
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::constructor_void_
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.10100856
add esp, 0x10
cmp dword [ebp - 0x358], edi
jg 0x100344ab
test ebx, ebx
je 0x10034441
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.10100856
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x1003446b
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], edi
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x1a4]
push 0x101684d4
push eax
call fcn.10100856
add esp, 0x10
mov ecx, eax
cmp dword [ebp - 0x358], edi
jg 0x100344ab
movzx eax, word [ecx]
xor edx, edx
test ax, ax
je 0x100344a3
mov ebx, eax
nop
cmp bx, 0x20
je 0x1003449b
add ecx, 2
mov byte [ebp + edx - 0x8c], bl
inc edx
movzx eax, word [ecx]
mov ebx, eax
test ax, ax
jne 0x10034480
cmp edx, 0x80
jae 0x100344f0
mov byte [ebp + edx - 0x8c], 0
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::destructor_void_
cmp byte [ebp - 0x8c], 0
je 0x100344d0
lea eax, [ebp - 0x8c]
push eax
call fcn.10100856
add esp, 4
mov edi, eax
test esi, esi
je 0x100344dd
push esi
call fcn.10100856
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e580b
mov esp, ebp
pop ebp
ret
call fcn.10100856
int3
Function at 0x100a5380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154133
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 4], vtable.icu_67::UnicodeMatcher.0
mov esi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov dword [edi], vtable.icu_67::UnicodeSet.0
mov dword [edi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x19
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push dword [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.10100856
test al, al
je 0x100a5581
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
shl eax, 2
push eax
push dword [esi + 8]
push dword [edi + 8]
call fcn.10108470
mov eax, dword [esi + 0x2c]
add esp, 0xc
test eax, eax
je 0x100a5528
cmp dword [eax + 4], 0
je 0x100a5528
push 0x18
mov dword [ebp - 0x10], 0
call fcn.10100856
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100a5488
lea ecx, [ebp - 0x10]
push ecx
push 1
push sym.icuuc67.dll_uhash_compareUnicodeString_67
push sym.icuuc67.dll_uprv_deleteUObject_67
mov ecx, eax
call fcn.10100856
mov ebx, eax
jmp 0x100a548a
xor ebx, ebx
mov byte [ebp - 4], 0
mov dword [edi + 0x2c], ebx
test ebx, ebx
jne 0x100a549e
mov dword [ebp - 0x10], 7
jmp 0x100a54d8
cmp dword [ebp - 0x10], 0
jle 0x100a54bf
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1015821c]
mov ecx, ebx
call esi
mov dword [edi + 0x2c], 0
jmp 0x100a54d8
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push 0x100a6cb0
push dword [esi + 0x2c]
call fcn.10100856
cmp dword [ebp - 0x10], 0
jle 0x100a5528
cmp dword [edi + 0x18], 0
jne 0x100a5522
cmp dword [edi + 0x30], 0
jne 0x100a5522
mov eax, dword [edi + 8]
mov dword [eax], 0x110000
mov eax, dword [edi + 0x24]
mov dword [edi + 0x10], 1
test eax, eax
je 0x100a5512
push eax
call fcn.10100856
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100a551e
call sym.icuuc67.dll_public:_void___thiscall_icu_67::UVector::removeAllElements_void_
mov byte [edi + 0x14], 0
mov byte [edi + 0x14], 1
jmp 0x100a5581
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0x100a5581
mov eax, dword [edi + 0x24]
mov esi, dword [esi + 0x28]
test eax, eax
je 0x100a5550
push eax
call fcn.10100856
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea eax, [esi*2 + 2]
push eax
call fcn.10100856
add esp, 4
mov dword [edi + 0x24], eax
test eax, eax
je 0x100a5581
push esi
push ebx
push eax
mov dword [edi + 0x28], esi
call fcn.10100856
mov ecx, dword [edi + 0x28]
add esp, 0xc
mov eax, dword [edi + 0x24]
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a55a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154158
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_67::UnicodeSet.0
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10100856
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a5650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154188
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call fcn.10100856
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100a81d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 0xc], ebx
push edi
mov eax, dword [ebx + 0xc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
test eax, eax
jle 0x100a8233
mov eax, dword [ebx + 4]
movzx edx, byte [ebp + 8]
mov dword [ebp - 8], eax
nop dword [eax]
mov ebx, dword [eax + esi*8 + 4]
mov ecx, dword [eax + esi*8]
dec ebx
mov eax, ebx
movzx edi, cl
xor eax, ecx
test eax, 0xffffff00
jne 0x100a821c
cmp edi, edx
ja 0x100a8227
jmp 0x100a8220
cmp edi, edx
jbe 0x100a827c
movzx eax, bl
cmp edx, eax
jbe 0x100a827c
mov eax, dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 4]
jl 0x100a8200
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x100a8271
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100a8271
xor esi, esi
test ecx, ecx
jle 0x100a8271
movzx edi, byte [ebp + 8]
nop dword [eax + eax]
push esi
mov ecx, eax
call fcn.10100856
push 0
mov ecx, eax
call fcn.10100856
movzx eax, al
cmp eax, edi
je 0x100a827c
mov eax, dword [ebx + 0x28]
inc esi
cmp esi, dword [eax + 4]
jl 0x100a8250
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100a96e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154548
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0x18]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x14]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 0x10]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10100856
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100a97a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154578
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0x14]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 0xc]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
push dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10100856
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100a9f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154688
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], vtable.icu_67::UnicodeSet.0
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10100856
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10100856
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10100865
pop dword [ebp - 0x20]
mov eax, 0x10100865
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x88b04
push 0
mov eax, 0x5bc409aa
add eax, 0xb4517782
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x8d96655f
add ecx, 0x7269dd82
mov esi, eax
mov edi, 0x876dae30
sub edi, 0x774cb430
add edi, dword [ebp - 0x20]
mov edx, 0x85f2328b
add edx, 0x786d725
xor dword [ebp - 0x1c], esi
mov ebx, dword [edi]
sub dword [ebp - 0xc], 0x87c98317
xor ebx, edx
mov dword [esi], ebx
add esi, 0x8e1b4d6
add esi, 0xf71e4b2e
add edi, 0x5961e29a
add edi, 0xa69e1d6a
loop 0x101008bf
add eax, 0x362f2de5
add eax, 0xc9d1d072
mov ebx, eax
add eax, 0xdd334181
sub eax, 0xdd33417c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1000a61a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014704]
jne 0x1000a624
repz ret
jmp fcn.1000ae86

Function at 0x1000ab43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000ab52
pop dword [ebp - 0x14]
mov eax, 0x97fc1ee8
sub eax, 0x87fb7396
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xe8b653e7
add dword [ebp - 0x24], 0x659bf164
mov dword [ebp - 0x20], 0x3de85c86
add dword [ebp - 0x20], 0xf44aefbf
mov dword [ebp - 0x1c], 0x8a5f5225
sub dword [ebp - 0x1c], 0x3e130df7
mov dword [ebp - 0x18], 0xec9f3746
add dword [ebp - 0x18], 0x1360c8ba
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x83a7f258
add dword [ebp - 0x24], 0xf0ca76fe
mov dword [ebp - 0x20], 0xde36f083
add dword [ebp - 0x20], 0x633570f2
mov dword [ebp - 0x1c], 0xf3bf3099
add dword [ebp - 0x1c], 0x6fb03bd3
mov dword [ebp - 0x18], 0xca4898d2
sub dword [ebp - 0x18], 0xca4898d2
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x9a2e9086
sub eax, 0x8a2dbf96
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3efd7
push 0
call eax
mov ecx, 0x75c4d180
add ecx, 0x8a3b9183
xor edx, edx
add edx, eax
mov esi, 0x10019c00
add esi, dword [ebp - 0x14]
mov ebx, 0xdf07c1cf
sub dword [ebp - 8], 0xd370c9f3
mov edi, dword [esi]
xor dword [ebp - 0xc], 0x72a28546
xor edi, ebx
xor dword [ebp - 4], eax
mov dword [edx], edi
add dword [ebp - 0x10], 0x83ceeeb7
add edx, 0x8f8579c6
sub edx, 0x8f8579c2
add esi, 0x980bbc4c
add esi, 0x67f443b8
loop 0x1000ac65
add eax, 0x8a9c8310
add eax, 0x7564fbcf
mov ebx, eax
add eax, 0x54279223
sub eax, 0x5427921e
mov ecx, 0x932eb770
sub ecx, 0x832eb770
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x41fcf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bd9a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5c49f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.00531d07
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x41fdb0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.00534c05
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x5b9ccc
push eax
call fcn.0053741c
push edi
push esi
call fcn.0053204f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053342f
mov esp, ebp
pop ebp
ret 4
Function at 0x424790
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c349
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5c49f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00430270
push 7
mov dword [ebp - 4], 0
mov ecx, esi
push str.update
mov dword [ebp - 0x2c], 1
call fcn.0042c490
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0042c2b0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42482f
test al, 0x10
je 0x42482f
mov edi, 1
jmp 0x424831
xor edi, edi
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x424846
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0042ce80
test edi, edi
jne 0x42488c
push 0xffffffffffffffff
push edi
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x28], 0
call fcn.0042c2b0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42488c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0042ce80
push 0xb
push str.update.zip
mov ecx, esi
call fcn.0042c490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053342f
mov esp, ebp
pop ebp
ret 4
Function at 0x4248c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c38f
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5c49f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0
call fcn.00430270
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], 1
mov ecx, esi
mov byte [ebp - 0x18], 0x5c
push eax
call fcn.0042bb00
push eax
push 0
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.0042a2b0
mov edi, eax
mov dword [ebp - 4], 1
cmp esi, edi
je 0x424979
cmp dword [esi + 0x14], 0x10
jb 0x424954
mov eax, dword [esi + 0x14]
mov ecx, esi
inc eax
push eax
push dword [esi]
call fcn.0042ce80
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x42496c
mov eax, dword [esi]
jmp 0x42496e
mov eax, esi
push edi
mov ecx, esi
mov byte [eax], 0
call fcn.0042c6c0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x424992
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.0042ce80
push 0xb
push str._addnewfile
mov ecx, esi
call fcn.0042c490
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
call fcn.0042c2b0
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4249e1
test al, 0x10
je 0x4249e1
mov edi, 1
jmp 0x4249e3
xor edi, edi
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x4249f8
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.0042ce80
test edi, edi
jne 0x424a3e
push 0xffffffffffffffff
push edi
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x34], 0
call fcn.0042c2b0
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
push edi
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x424a3e
inc ecx
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.0042ce80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053342f
mov esp, ebp
pop ebp
ret 4
Function at 0x428890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5c49f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x40
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x44
push 0
push eax
call fcn.00536540
add esp, 0xc
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x60]
xor eax, eax
cmp dword [ebp + 0x1c], 0x10
mov word [ebp - 0x20], ax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp + 0x1c]
mov esi, eax
neg esi
sbb esi, esi
cmp ecx, 0x10
jb 0x428908
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0042ce80
mov ecx, dword [ebp - 4]
lea eax, [esi + 1]
xor ecx, ebp
pop esi
call fcn.0053342f
mov esp, ebp
pop ebp
ret 0x18

Function at 0x428920
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x5c49f0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0xc]
push esi
push edi
push 0x124
push 0
push eax
or edi, 0xffffffff
call fcn.00536540
add esp, 0xc
mov dword [esp + 0x10], pe_nt_image_headers32
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, edi
je 0x4289c2
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
nop dword [eax + eax]
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x42899d
mov ecx, dword [esp + 0x18]
call fcn.00429760
test al, al
jne 0x4289b7
lea eax, [esp + 0x10]
mov dword [esp + 0x10], pe_nt_image_headers32
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x428980
jmp 0x4289bb
mov edi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053342f
mov esp, ebp
pop ebp
ret 4