joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f1de
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42f295
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42f26e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42f257
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42f255
push 0
push 0x19bc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x42f26c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0xe04822b1
jmp 0x42f293
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.00431354
add esp, 0x10
jmp 0x42f29d
push 0
call fcn.00428e55
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4324ca
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x432571
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43253a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43251c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x432538
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x432538
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x43256f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0x5d92
push 0x61c8
push 1
push 0x6e9d
push 0x3a9
push dword [ebp - 0x24]
push 0
push 1
push 0xbf7
push 0x5ee9
call fcn.0042edc2
add esp, 0x28
jmp 0x4325af
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0
push 0x74a2
push dword [ebp - 0x38]
push 1
call fcn.0042b4e6
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x433c53
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x433cdd
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x433cb7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x433ca8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x433ca6
push 0x7e9
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x433cb5
push 0x2387
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x433cdb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
push 0x75d1
push 1
push 0x20c2
push 0x7519
push dword [ebp - 0x18]
call fcn.0042e1b6
add esp, 0x18
jmp 0x433d0d
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0x1e3d
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push 1
call fcn.00430baf
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x4353e0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43545c
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x435429
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0x1a7b
push 1
push 0x3ec6
push dword [ebp - 0xc]
call fcn.00435472
add esp, 0x10
jmp 0x43545a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x435441
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43545a
push 0x1ab6
push 0x1450
push 0
push 0xd7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x43546e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 1
call fcn.00433a63
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x437063
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x437163
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x437150
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x437144
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4370d1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 5
jle 0x437142
mov dword [ebp - 0x24], 0xfffffffd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x437133
push 0x455d
push 0x1957
push 1
push 1
push 1
push 0x1e1c
push 0xc82
push 0x3b9d
push 0x5649
push 1
push 0x1375
push 0x16ae
push 0x47ee
push 0x34c6
push 0x693e
call fcn.00435010
add esp, 0x3c
lea eax, [ebp - 0x24]
push eax
push 0
call fcn.0043729b
pop ecx
pop ecx
jmp 0x4370c6
jmp 0x43714e
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x437161
push 0
push 0x6085
push 1
call fcn.0042ce0a
add esp, 0xc
jmp 0x437179
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
push 1
call fcn.00434ce4
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x437529
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4375d6
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4375aa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x437592
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4375a8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4375a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x4375d1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
push 0x3eca
push dword [ebp - 0x30]
push 0
push 1
push dword [ebp - 0x34]
push 1
push 1
call fcn.00433c53
add esp, 0x1c
jmp 0x437693
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x437665
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x43764c
mov dword [ebp - 0x58], 0xeac8
mov byte [ebp - 2], 0
push 1
push 1
lea eax, [ebp - 2]
push eax
push 0x72dd
push 0x318c
push 1
push 1
push 0x12b1
call fcn.00435952
add esp, 0x20
push 0
push 0x48ff
call fcn.0043f1ca
pop ecx
pop ecx
jmp 0x437663
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x437693
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
push 0x5236
push 0x342b
push 1
push 0x5b82
push dword [ebp - 0x54]
push 1
push 0x5c1
push 0x4172
call fcn.0042f2cb
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x43b1aa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43b259
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43b23b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43b219
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43b239
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43b239
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x43b257
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 1
push 0x423d
push dword [ebp - 0x34]
push 1
push 1
call fcn.0043b134
add esp, 0x14
jmp 0x43b283
push 0
push 0x248b
push 1
push 0x3a9a
push 0x4c42
push 0x336a
push 0xed7
push 0x608a
call fcn.0042e2fb
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x43bad9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43bb56
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43bb17
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 1
push dword [ebp - 0x14]
call fcn.0043bc85
pop ecx
pop ecx
jmp 0x43bb51
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push 0x2b60
push 1
push 0x33ba
push 1
push 0x7719
push 0x56a6
push 0x5797
push 0x29ae
push 0x6dbb
push dword [ebp - 0x1c]
call fcn.0042ce58
add esp, 0x2c
jmp 0x43bc81
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43bc66
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43bc3d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43bbee
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jg 0x43bc3b
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x43bc00
jmp 0x43bc3b
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x43bc16
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x43bc39
mov dword [ebp - 0x58], 0x72305aba
mov eax, dword [ebp - 0x54]
cmp dword [eax], 0
je 0x43bc2f
jmp 0x43bc39
cmp dword [ebp - 0x58], 0
je 0x43bc37
jmp 0x43bc39
jmp 0x43bc0b
jmp 0x43bbe3
jmp 0x43bc64
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x43bc64
push 0xdcc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x43bc81
push 0
push 0x7254
push 0x1224
push 0x7eb0
push 1
call fcn.00432ff0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43c1b9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43c211
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
push 0x720d
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0xc]
push 1
push 0x578e
push 0x17fa
push dword [ebp - 0x10]
push 0x2648
push dword [ebp - 0x14]
call fcn.0043c287
add esp, 0x28
jmp 0x43c283
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43c264
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43c25c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43c262
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x43c283
push 0x7c0
push 0x6b7b
push 0
push 1
push 0x3581
push 1
push 0
call fcn.00433c53
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x43e36e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43e3bd
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43e396
push 0
call fcn.0044026d
pop ecx
jmp 0x43e3b8
push 0x36d8
push 0x5876
push 0
push 0x21a4
push 0
push 1
push 0x491b
call fcn.0043e564
add esp, 0x1c
jmp 0x43e450
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43e408
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 1
push dword [ebp - 0x20]
push 0x6fe1
call fcn.00435a98
add esp, 0x10
jmp 0x43e450
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43e437
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43e450
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43e450
push 0x26cb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x43efc6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43f0e4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43f0be
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43f04f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43f04d
push 0
push 0
push 0
push 0
push 0x19b4
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x43f0bc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43f071
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffe3
jge 0x43f0bc
push 0x2f4
push 0x5354
push 0x3f54
push 0x17f1
push 0x6655
push 1
push 1
push 0x7bfb
push 0x2aac
push 1
push 0
push 0x40d1
push 0
push 0xdda
push 1
call fcn.0043c2c2
add esp, 0x3c
jmp 0x43f066
jmp 0x43f0e2
push 1
push 0
push 0x1a1f
push 0x7771
push 0x67d4
push 1
push 0
push 0x78a8
call fcn.00435952
add esp, 0x20
jmp 0x43f134
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x43f114
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0x4da
push 1
call fcn.00429150
add esp, 0xc
jmp 0x43f134
push 0x5386
push 0
push 0x4b44
push 0x6331
push 0
push 0x6cbc
call fcn.0042a28a
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x440288
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4402cf
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x2b7
push 1
push 0x1536
push 0xa36
push 1
push 0x3844
push 0x70c7
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 0x4a66
call fcn.00440349
add esp, 0x24
jmp 0x440345
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44031d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x440313
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x440311
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x44031b
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x440345
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 1
push 0x6f7e
push 1
push 0
push 0x5b72
push 0
push 0x6daa
call fcn.00435b66
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x44e8c1
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x44e9ad
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44e974
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x44e95b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 1
jmp 0x44e939
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe6
jg 0x44e959
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44e957
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x44e92e
jmp 0x44e972
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x44e9ab
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x434d
push dword [ebp - 0x38]
push 0x22af
push 0x2183
push 0
push 0x15ce
push 1
push 0x2eb2
push 0x6838
push 1
push 0
call fcn.0045cdeb
add esp, 0x2c
jmp 0x44e9bb
push 0x1a40
push 0
call fcn.0044e7b0
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x451362
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x45141e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4513fb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4513dc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x4513f9
push 0
push 0
push 0
push 0
push 0x19b4
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x45141c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0x18da
push 1
push dword [ebp - 0x34]
push 0
push 1
push 0x3030
call fcn.0044d0c3
add esp, 0x18
jmp 0x451436
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
push 0
push 0x1843
push dword [ebp - 0x38]
call fcn.0045119c
add esp, 0xc
mov esp, ebp
pop ebp
ret