joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434b30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
cmp dword [edi + 0x10], 0
je 0x434ba4
mov ebx, dword [ebp + 8]
cmp ebx, 1
jl 0x434ba4
mov eax, dword [edi + 0x14]
push esi
lea esi, [ebx + 0x3ff]
and esi, 0xfffffc00
test eax, eax
je 0x434b67
cmp dword [edi + 0x18], esi
jae 0x434b7e
push eax
call fcn.005bb20e
add esp, 4
test esi, esi
je 0x434b7e
push esi
call fcn.005bb17a
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
je 0x434b7e
mov dword [edi + 0x18], esi
mov eax, dword [edi + 0x14]
pop esi
test eax, eax
je 0x434b9b
mov ecx, dword [edi + 0x10]
push ecx
push ebx
push 1
push eax
call fcn.005bc8fb
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [edx], eax
mov eax, dword [edi + 0x14]
pop edi
pop ebx
pop ebp
ret 8
pop edi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x435040
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0xb8], ebx
jne 0x43508d
mov eax, dword [esi + 0x120]
push ebx
push ebx
push 0x1009
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 4
push ebx
push 0xffffffffffffffff
push esi
push 0x435000
call fcn.004bb3f9
mov dword [esi + 0xb8], eax
test eax, eax
je 0x43508d
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, 1
push 0x665
mov ecx, esi
call fcn.004b3c82
test eax, eax
je 0x4350b0
xor edx, edx
cmp dword [esi + 0xb8], edx
mov ecx, eax
sete dl
push edx
call fcn.004b3f26
push 1
mov ecx, esi
call fcn.004b3c82
mov edi, eax
test edi, edi
je 0x4350de
add esi, 0x100
push esi
call fcn.0041c320
xor ecx, ecx
add esp, 4
cmp eax, 0xffffffff
setg cl
push ecx
mov ecx, edi
call fcn.004b3f26
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x435920
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x10c], eax
movzx eax, byte [ebp + 0x14]
push eax
lea ecx, [ebp - 0x108]
mov edi, eax
push ebx
push ecx
and edi, 7
call fcn.004356f0
lea edx, [ebp - 0x108]
push 0x5f7dc0
push edx
call fcn.005bc9d4
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4359a1
test byte [ebp + 0x14], 0x70
je 0x4359f5
push edi
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.004356f0
lea ecx, [ebp - 0x108]
push 0x5f7dc0
push ecx
call fcn.005bc9d4
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4359f5
test dword [ebx + 4], 0x100
je 0x4359b3
mov edi, dword [edi*4 + 0x5fb140]
jmp 0x4359ba
mov edi, dword [edi*4 + 0x5fb160]
mov edx, edi
imul edx, dword [ebp + 0xc]
push 0
push edx
push esi
call fcn.005bcb9e
mov eax, dword [ebp - 0x10c]
push esi
push 1
push edi
push eax
call fcn.005bc8fb
push esi
call fcn.005bcc87
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
Function at 0x435a90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd87b
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x118], ebx
call fcn.0047fc60
mov dword [ebx], vtable.CFontLib_ASCII.0
cmp dword [0x66d5b8], 0
mov dword [ebp - 4], 0
jne 0x435b47
mov eax, dword [0x66dac0]
push str.asc.fmd
push eax
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
call fcn.005bbf72
lea edx, [ebp - 0x114]
push 0x5f7dc0
push edx
call fcn.005bc9d4
mov esi, eax
add esp, 0x18
test esi, esi
je 0x435b47
push esi
call fcn.00489860
mov edi, eax
push edi
call fcn.005bb17a
add esp, 8
mov dword [0x66d5b8], eax
test eax, eax
je 0x435b3e
push esi
push edi
push 1
push eax
call fcn.005bc8fb
add esp, 0x10
push esi
call fcn.005bcc87
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret

Function at 0x435bc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x108]
mov esi, eax
push 0x5fb118
push ecx
mov dword [ebp - 0x10c], 0
and esi, 7
call fcn.004356f0
mov ebx, dword [esi*4 + 0x5fb140]
mov edi, ebx
imul edi, dword [ebp + 0x10]
add esp, 0xc
cmp esi, 4
jg 0x435c1f
add edi, dword [esi*4 + 0x5fb180]
lea edx, [ebp - 0x108]
push 0x5f7dc0
push edx
call fcn.005bc9d4
mov esi, eax
add esp, 8
test esi, esi
je 0x435c84
push 0
push edi
push esi
call fcn.005bcb9e
add esp, 0xc
test eax, eax
jne 0x435c60
mov eax, dword [ebp - 0x110]
push esi
push 1
push ebx
push eax
call fcn.005bc8fb
add esp, 0x10
test eax, eax
jne 0x435c66
mov ebx, dword [ebp - 0x10c]
push esi
call fcn.005bcc87
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bb30e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x108]
push str.ascii.lmf
push eax
mov esi, ebx
call fcn.004357a0
lea ecx, [ebp - 0x108]
push 0x5f7dc0
push ecx
call fcn.005bc9d4
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4360f8
push 0x104
lea edx, [ebp - 0x108]
push 0
push edx
call fcn.005bb320
push edi
push 0x104
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.005bc8fb
lea ecx, [ebp - 0xf8]
push ecx
call fcn.00488800
mov edx, 1
add esp, 0x20
cmp dx, ax
ja 0x4360ef
lea eax, [ebp - 0xf6]
push eax
call fcn.00488820
lea ecx, [ebp + eax - 0xf8]
push ecx
call fcn.00488800
movzx esi, ax
and esi, 0x1ff
not esi
add esp, 8
and esi, ebx
push edi
call fcn.005bcc87
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
Function at 0x4363e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x120], edi
cmp eax, 7
ja 0x4364ba
test eax, eax
jne 0x436424
lea eax, [ebp - 0x18]
push str.ascii.lmf
push eax
call fcn.005bbf72
add esp, 8
jmp 0x436436
push eax
lea ecx, [ebp - 0x18]
push str.ascii__d.lmf
push ecx
call fcn.005bbf72
add esp, 0xc
push esi
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x11c]
push eax
call fcn.004357a0
lea ecx, [ebp - 0x11c]
push 0x5f7dc0
push ecx
call fcn.005bc9d4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4364a5
push esi
call fcn.00489860
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
lea edx, [ecx + edi]
add esp, 4
cmp eax, edx
jl 0x436496
push 0
push ecx
push esi
call fcn.005bcb9e
push esi
push edi
push 1
push ebx
call fcn.005bc8fb
add esp, 0x1c
cmp eax, edi
mov edi, 1
je 0x43649c
mov edi, dword [ebp - 0x120]
push esi
call fcn.005bcc87
add esp, 4
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.005bb30e
mov esp, ebp
pop ebp
ret 0x10

Function at 0x436790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, 7
ja 0x436884
test eax, eax
jne 0x4367cd
lea eax, [ebp - 0x18]
push str.ascii.lmf
push eax
call fcn.005bbf72
add esp, 8
jmp 0x4367df
push eax
lea ecx, [ebp - 0x18]
push str.ascii__d.lmf
push ecx
call fcn.005bbf72
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x180]
push eax
call fcn.004357a0
add esp, 8
push ebx
lea ecx, [ebp - 0x180]
push 0x5f7dc0
push ecx
call fcn.005bc9d4
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x43686f
push ebx
push 1
lea edx, [ebp - 0x7c]
push 0x64
push edx
call fcn.005bc8fb
add esp, 0x10
test eax, eax
je 0x436866
lea eax, [ebp - 0x6c]
push eax
call fcn.00488800
add esp, 4
test ax, ax
je 0x436866
lea ecx, [ebp - 0x6a]
push ecx
call fcn.00488820
add esp, 4
cmp eax, 0x5e
jg 0x436866
mov edx, dword [ebp + eax - 0x7c]
mov ecx, dword [ebp + eax - 0x78]
lea eax, [ebp + eax - 0x7c]
mov dword [esi], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov edi, 1
push ebx
call fcn.005bcc87
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.005bb30e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x438730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dda38
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x50], edi
call fcn.004b5c24
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43877e
push 0x80004005
call fcn.004047e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x4c], ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], eax
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x43888d
mov edi, dword [edi]
lea ecx, [ebp - 0x44]
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x43888d
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea edi, [esi + 8]
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
lea edx, [ebp - 0x20]
mov word [esi + 0x24], ax
push edx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [ebp - 0x14]
movzx edx, word [ebp - 0x16]
movzx eax, word [ebp - 0x18]
push ecx
movzx ecx, word [ebp - 0x1a]
push edx
movzx edx, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push ecx
push edx
push eax
lea ecx, [ebp - 0x4c]
push str._04d_02d_02d_02d_02d_02d
push ecx
call fcn.004065c0
mov ebx, dword [ebp - 0x4c]
add esp, 0x20
cmp dword [ebx - 0xc], 0xe
jne 0x438847
mov edx, dword [ebx]
mov dword [esi + 0x18], edx
mov eax, dword [ebx + 4]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebx + 8]
mov dword [esi + 0x20], ecx
mov dx, word [ebx + 0xc]
mov word [esi + 0x24], dx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, ecx
je 0x438869
mov edx, ecx
mov cl, 0x20
call fcn.005bd6f0
mov dword [esi], eax
mov eax, dword [ebp - 0x24]
add dword [esi], eax
mov dword [esi + 4], edx
adc dword [esi + 4], 0
jmp 0x438871
mov edx, dword [ebp - 0x24]
mov dword [esi], edx
mov dword [esi + 4], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
push eax
push 0x10
push edi
call fcn.004215c0
add esp, 0xc
test eax, eax
je 0x43888d
mov dword [ebp - 0x48], 1
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4388b0
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
Function at 0x43de20
Capabilities:
Check os version
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0xe8]
push eax
xor esi, esi
mov dword [ebp - 0xf4], 0x50
mov dword [ebp - 0xe8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x43de6a
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xd8]
dec eax
je 0x43decb
dec eax
jne 0x43df59
cmp dword [ebp - 0xe4], 5
jb 0x43de91
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
jmp 0x43df54
call fcn.0043dd90
movzx esi, ax
mov ecx, 0x409
cmp si, cx
jne 0x43df54
call fcn.0043dde0
test eax, eax
je 0x43df62
mov esi, 0xc04
mov ax, si
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xec]
push edx
push 1
push 0
push str.DefaultControl_PanelDesktopResourceLocale
push reloc.oledlg.dll_OleUIAddVerbMenuA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43df59
mov ecx, dword [ebp - 0xec]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push eax
lea eax, [ebp - 0xf0]
push eax
push 0
push 0
push ecx
call edi
test eax, eax
jne 0x43df46
cmp dword [ebp - 0xf0], 1
jne 0x43df46
lea edx, [ebp - 0xf4]
push edx
mov edx, dword [ebp - 0xec]
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0xf0]
push ecx
push 0
push 0
push edx
call edi
test eax, eax
jne 0x43df46
lea eax, [ebp - 0x54]
push eax
call fcn.005bc04b
add esp, 4
movzx esi, ax
mov ecx, dword [ebp - 0xec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test si, si
jne 0x43df62
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx esi, ax
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
Function at 0x43df80
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de1eb
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
call fcn.004b5c24
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43dfd1
push 0x80004005
call fcn.004047e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x158], eax
push 0xffffffffffffffff
push 0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004cc721
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.004c40c7
mov eax, dword [esi + 8]
push str.Auto
push eax
mov ecx, esi
call fcn.004cca73
mov eax, dword [edi + 8]
push 0
push eax
mov ecx, edi
call fcn.004c41e6
push ebx
lea ecx, [ebp - 0x158]
push str._slang.dll
push ecx
mov dword [ebp - 0x154], 1
call fcn.004065c0
mov eax, dword [ebp - 0x158]
add esp, 0xc
lea edx, [ebp - 0x150]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
mov dword [ebp - 0x15c], ebx
cmp ebx, 0xffffffff
je 0x43e113
test byte [ebp - 0x150], 0x20
je 0x43e0f7
push 4
lea ecx, [ebp - 0x124]
push ecx
push str.lang
call fcn.005bf092
add esp, 0xc
test eax, eax
jne 0x43e0f7
mov al, byte [ebp - 0x120]
xor edx, edx
lea ecx, [ebp - 0x120]
test al, al
je 0x43e0f7
lea ebx, [ebx]
cmp al, 0x2e
je 0x43e0b3
sub al, 0x30
cmp al, 9
ja 0x43e0f7
mov al, byte [ecx + 1]
inc ecx
inc edx
test al, al
jne 0x43e0a0
test edx, edx
jle 0x43e0f7
lea edx, [ebp - 0x120]
push edx
call fcn.005bc04b
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x43e0f7
push ebx
call fcn.0043dd20
add esp, 4
test eax, eax
je 0x43e0f7
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
call fcn.004cca73
mov eax, dword [edi + 8]
push ebx
push eax
mov ecx, edi
call fcn.004c41e6
inc dword [ebp - 0x154]
mov ebx, dword [ebp - 0x15c]
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43e061
push 0x409
call fcn.0043dd20
add esp, 4
test eax, eax
je 0x43e146
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
call fcn.004cca73
mov eax, dword [edi + 8]
push 0x409
push eax
mov ecx, edi
call fcn.004c41e6
inc dword [ebp - 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x158]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43e176
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
Function at 0x43e750
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x104], 0
je 0x43e7f8
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esi + 0x108]
mov ecx, eax
shr ecx, 0x10
cmp cx, ax
je 0x43e7f8
mov edx, dword [ebp - 0x1c]
shl edx, 8
or edx, dword [ebp - 0x1a]
or eax, 0xffff0000
mov dword [esi + 0x108], eax
cmp dx, ax
jne 0x43e7f8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x28]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x10]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0x28]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x40000
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov edx, dword [ebp + 8]
push edx
mov ecx, esi
call fcn.004ccf85
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005bb30e
mov esp, ebp
pop ebp
ret 4
Function at 0x43f780
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de431
mov eax, dword fs:[0]
push eax
mov eax, 0x234e8
call fcn.005bce40
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x234d4], ecx
lea ecx, [ebp - 0x234cc]
call fcn.00460ff0
mov eax, dword [0x66dac8]
push 1
push ecx
add eax, 0xfffffff0
xor esi, esi
mov dword [ebp - 0x234d0], esp
mov edi, esp
push eax
mov dword [ebp - 4], esi
call fcn.00405fe0
add eax, 0x10
add esp, 4
lea ecx, [ebp - 0x234cc]
mov dword [edi], eax
call fcn.00461090
mov eax, dword [ebp - 0x234c4]
cmp eax, esi
jle 0x43f914
mov edi, dword [ebx + 0x2c]
cmp edi, esi
jle 0x43f813
cmp edi, eax
jg 0x43f813
dec edi
jmp 0x43f815
xor edi, edi
mov eax, edi
imul eax, eax, 0x52
movzx ecx, byte [ebp + eax - 0x234be]
movzx edx, word [ebp + eax - 0x234c0]
lea esi, [ebp + eax - 0x234c0]
push ecx
push edx
lea ecx, [ebp - 0x234f4]
call fcn.00434870
lea eax, [ebp - 0x234d0]
push eax
lea ecx, [ebp - 0x234f4]
mov byte [ebp - 4], 1
mov dword [ebp - 0x234d8], esi
call fcn.0043d290
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esi, eax
mov eax, dword [ebp - 0x234d0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43f887
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x43f8f4
mov ecx, dword [ebp - 0x234d4]
lea edx, [ebp - 0x234d0]
mov dword [ecx + 0x110], edi
push edx
lea ecx, [ebp - 0x234f4]
call fcn.0043d290
lea ecx, [ebx + 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.00406510
mov eax, dword [ebp - 0x234d0]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43f8dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x234f4]
mov dword [ebx + 0x14], 1
mov byte [ebp - 4], 0
call fcn.00430810
jmp 0x43f91f
lea ecx, [ebx + 0x18]
call fcn.00405ef0
lea ecx, [ebp - 0x234f4]
mov dword [ebx + 0x14], 0
mov byte [ebp - 4], 0
call fcn.00430810
jmp 0x43f91f
lea ecx, [ebx + 0x18]
call fcn.00405ef0
mov dword [ebx + 0x14], esi
lea ecx, [ebp - 0x234cc]
mov dword [ebp - 4], 0xffffffff
call fcn.0045ff10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret 4
Function at 0x442800
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de906
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x13c], edi
call fcn.004cae19
mov dword [ebp - 4], 0
call fcn.004b5c24
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x442866
push 0x80004005
call fcn.004047e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x138], eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004c3db3
lea ecx, [ebp - 0x134]
push ecx
push esi
call fcn.0040f240
add esp, 8
test eax, eax
je 0x4428d6
mov eax, dword [ebp - 0x138]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4428bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], 0xffffffff
call fcn.004cb00b
xor eax, eax
jmp 0x442a2c
push 0x104
lea ecx, [ebp - 0x124]
push 0
push ecx
call fcn.005bb320
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
cmp eax, esi
jbe 0x442911
sub eax, esi
cmp eax, 0x104
jae 0x442911
push eax
lea edx, [ebp - 0x124]
push esi
push edx
call fcn.005bc350
add esp, 0xc
xor eax, eax
xor esi, esi
cmp ax, word [ebp - 0x12c]
jae 0x4429e0
mov bl, byte [ebp + 0x10]
mov edi, 0x10
lea ebx, [ebx]
mov ecx, dword [ebp - 0x134]
push 0
push edi
push ecx
call fcn.005bcb9e
add esp, 0xc
test eax, eax
jne 0x4429cd
mov edx, dword [ebp - 0x134]
push edx
push 1
lea eax, [ebp - 0x20]
push 0x10
push eax
call fcn.005bc8fb
add esp, 0x10
test eax, eax
je 0x4429cd
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x138]
push 0x5f7dc4
push eax
mov byte [ebp - 0x14], 0
call fcn.004065c0
add esp, 0x10
test bl, 1
je 0x44299e
mov ecx, dword [ebp - 0x138]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4429cd
test bl, 2
je 0x4429bb
mov edx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x13c]
push 0
push edx
call fcn.004c3d7d
test eax, eax
jne 0x4429cd
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
push eax
call fcn.004c3f16
movzx ecx, word [ebp - 0x12c]
inc esi
add edi, 0x10
cmp esi, ecx
jl 0x442930
mov edx, dword [ebp - 0x134]
push edx
call fcn.005bcc87
mov eax, dword [ebp - 0x138]
add eax, 0xfffffff0
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x442a15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], 0xffffffff
call fcn.004cb00b
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret