joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454d80
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x454d97
add esp, 0xfffffff0
call fcn.00403ce4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041bb98
mov eax, dword [0x471c1c]
cmp word [eax + 2], 0
jne 0x454dbf
mov eax, dword [0x471c1c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00456458
mov eax, dword [0x471d2c]
cmp word [eax + 2], 0
jne 0x454dd9
mov eax, dword [0x471d2c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00456650
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4128dc]
call fcn.00403990
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4128dc]
call fcn.00403990
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41e0d4]
call fcn.0042544c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x454f60
mov eax, dword [0x471ad4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042581c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x456c00
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x471ad4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d2d8
test eax, eax
je 0x454ece
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409334
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d300
test eax, eax
je 0x454ee2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a04
mov eax, dword [0x4718f4]
cmp byte [eax], 0
jne 0x454f16
mov eax, ebx
call fcn.00455088
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00456ddc
mov eax, ebx
call fcn.004577a0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x454f56
call fcn.00403d3c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455308
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x472be0]
cmp dword [eax + 0x30], 0
je 0x4553b2
cmp dword [ebx + 0x94], 0
jne 0x4553ac
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x455298
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4553ac
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x455372
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4553ac
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414fc8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x455381
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x455f14
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x455f49
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404884
jmp 0x455f56
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004047e8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x456fb8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x456ff9
mov eax, esi
call fcn.0043d770
test al, al
je 0x456ff9
mov eax, dword [ebx + 0x84]
call fcn.0043d46c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456ff9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d46c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4355f4
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45e51f], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov esi, ecx
je 0x4356a5
test eax, eax
jne 0x43562d
movzx eax, byte [0x457923]
push eax
push edx
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov al, 1
jmp 0x4356a7
xor ebx, ebx
cmp dword [0x45e648], ebx
jne 0x43564f
push 0xf0000000
push 0x18
push ebx
push ebx
push 0x45e648
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4356a5
push ebx
push ebx
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x4356a5
push ebx
push ebx
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4356a5
lea eax, [ebp - 4]
push eax
mov eax, dword [0x457a40]
push ebx
push ebx
push dword [eax*4 + 0x404ae0]
push dword [0x45e648]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4356ae
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
push ebx
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4356cb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x43569e
movzx eax, byte [0x457923]
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x4356ee
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov al, bl
jmp 0x4356a7

Function at 0x4359a4
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jne 0x4359c2
mov edx, dword [edi + 8]
mov cl, 1
call fcn.004358b5
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x435a17
xor ebx, ebx
test byte [edi + 0x3d], 8
je 0x4359de
mov edx, dword [edi + 0x40]
mov ecx, eax
push ebx
push ebx
call fcn.0043587e
test eax, eax
jne 0x435a17
and byte [edi + 0x3d], 0xf7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], ebx
movzx eax, word [edi + 0x4a]
push eax
mov eax, dword [edi + 0x4c]
add eax, 0x200
push eax
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0
jne 0x435a17
add dword [edi + 0x40], ebx
mov word [edi + 0x4a], bx
pop edi
pop ebx
ret
mov edx, dword [edi + 8]
mov ecx, 0x3eb
call fcn.0043b6f1
int3
Function at 0x435dbe
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push 0x42805c
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x435ddf
inc eax
jmp 0x435e90
push esi
push edi
push 0x42806c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x428088
push edi
call esi
push 0x4280a8
push edi
mov dword [ebp - 4], eax
call esi
xor ecx, ecx
mov esi, eax
mov eax, dword [ebp - 4]
mov edi, ecx
mov dword [ebp - 8], ecx
test eax, eax
je 0x435e25
test esi, esi
je 0x435e25
lea ecx, [ebp - 8]
push ecx
call eax
mov edi, eax
xor ecx, ecx
push ecx
push 0x80
push 3
push ecx
push ecx
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x435e8c
test edi, edi
je 0x435e4b
push dword [ebp - 8]
call esi
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x435e8c
push esi
push eax
push esi
push 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x435e8c
push esi
push esi
push esi
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
push edi
test esi, esi
jne 0x435e95
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
call eax
test eax, eax
je 0x435e8c
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00435bdc
test eax, eax
jne 0x435edb
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00435ced
test eax, eax
jne 0x435ed8
mov eax, dword [0x473ad8]
test eax, eax
je 0x435ed8
push edi
push eax
call dword [0x473ad0]
mov edi, dword [ebp - 4]
mov eax, dword [edi]
xor edx, edx
or eax, 0xc0000000
cmp word [esi], dx
jne 0x435eff
mov ecx, 0xffff
cmp word [esi + 2], cx
jne 0x435eff
cmp word [esi + 4], dx
je 0x435f02
mov dword [esi + 8], eax
jmp 0x435f02
mov dword [esi + 4], eax
push 1
push edi
call fcn.004557e4
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x435e8c
push ebx
call dword [ebp - 0x10]
test eax, eax
je 0x435e8c
xor eax, eax
inc eax
jmp 0x435e8e
Function at 0x436e07
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x18], ecx
mov ebx, dword [ebx]
xor cl, cl
mov dword [ebp - 0x1c], edi
mov esi, dword [edi]
jmp 0x436fbf
dec esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebx + esi*4]
cmp word [eax], 0x40
jne 0x436fbf
test cl, cl
je 0x436e4c
mov ecx, 0x2338
call fcn.0043afb9
mov ecx, eax
call fcn.00438669
mov edi, dword [edi]
sub edi, esi
mov byte [ebp - 2], 1
mov dword [ebp - 0x10], 0
sub edi, 1
je 0x436e8e
xor ecx, ecx
mov eax, edi
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.0044c392
mov ecx, edi
mov dword [ebp - 0x10], eax
shl ecx, 2
push ecx
lea ecx, [esi + 1]
lea ecx, [ebx + ecx*4]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ebx, dword [ebx + esi*4]
mov cl, 1
add ebx, 2
mov edx, ebx
call fcn.004358b5
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x436fce
lea ecx, [ebp - 0xc]
xor edx, edx
push ecx
push 2
mov ecx, eax
call fcn.0043587e
test eax, eax
jne 0x436fd7
mov ecx, dword [ebp - 0xc]
add ecx, 2
call fcn.0044c392
mov ecx, dword [ebp - 8]
xor edx, edx
push 0
push 0
mov esi, eax
call fcn.0043587e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [ebp - 0xc]
push esi
push dword [ebp - 8]
and dword [eax], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0
jne 0x436fd7
mov ecx, dword [ebp - 8]
call fcn.00435967
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov byte [ebp - 1], cl
mov word [esi + eax], cx
mov al, byte [esi]
cmp al, 0xff
jne 0x436f28
cmp byte [esi + 1], 0xfe
jne 0x436f42
lea ebx, [esi + 2]
jmp 0x436f4f
cmp al, 0xef
jne 0x436f42
cmp byte [esi + 1], 0xbb
jne 0x436f42
cmp byte [esi + 2], 0xbf
jne 0x436f42
lea ecx, [esi + 3]
call fcn.0044c627
jmp 0x436f49
mov ecx, esi
call fcn.0044c5a0
mov byte [ebp - 1], 1
mov ebx, eax
push dword [ebp + 8]
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.00437b6c
cmp byte [ebp - 1], 0
je 0x436f6e
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
pop ecx
test edi, edi
je 0x436fb2
mov eax, dword [ebp - 0x18]
lea edx, [edi + esi]
mov dword [eax], edx
mov ecx, dword [ebx]
shl edx, 2
call fcn.0044c3b7
mov ecx, edi
mov dword [ebx], eax
shl ecx, 2
push ecx
push dword [ebp - 0x10]
lea eax, [eax + esi*4]
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
mov ebx, dword [ebx]
lea eax, [edi + esi]
mov edi, dword [ebp - 0x1c]
mov cl, byte [ebp - 2]
mov dword [edi], eax
test esi, esi
jne 0x436e26
pop edi
pop esi
pop ebx
leave
ret 4
mov edx, ebx
mov ecx, 0x3e8
jmp 0x436fde
mov edx, ebx
mov ecx, 0x3eb
call fcn.0043b6f1
int3
Function at 0x436fe4
Capabilities:
Resolve path using msvcrt
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ecx, dword [0x46fdac]
mov dword [ebp - 4], esi
test ecx, ecx
je 0x437008
call fcn.004409c5
mov dword [0x46fdac], esi
mov ecx, dword [0x45fa7c]
test ecx, ecx
je 0x43701d
call fcn.004409c5
mov dword [0x45fa7c], esi
mov ecx, dword [0x46fed4]
test ecx, ecx
je 0x437032
call fcn.004409c5
mov dword [0x46fed4], esi
mov ecx, dword [0x4713ac]
test ecx, ecx
je 0x437049
mov esi, dword [ecx]
call fcn.004409c5
mov ecx, esi
test esi, esi
jne 0x43703c
cmp byte [0x457a4d], 0
mov ebx, dword [0x45fa28]
mov eax, dword [0x45fa2c]
mov ecx, dword [0x45fa24]
jne 0x43706e
mov dword [ebx + eax*4], 0x428970
inc eax
add ecx, 3
mov dword [ebx + eax*4], 0x428978
lea edx, [edi + 2]
mov dword [ebx + eax*4 + 4], edi
add eax, 2
mov dword [0x45fa2c], eax
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x437084
mov esi, dword [0x45fa30]
sub edi, edx
mov edx, dword [0x45fa34]
add esi, 4
sar edi, 1
add edi, 5
mov dword [0x45fa30], esi
add edi, ecx
dec edx
mov dword [0x45fa24], edi
mov dword [0x45fa34], edx
test edx, edx
jle 0x437106
mov ecx, dword [0x45fa2c]
mov eax, dword [esi]
mov dword [ebx + ecx*4], eax
inc ecx
mov dword [0x45fa2c], ecx
mov ecx, dword [esi]
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x4370d8
sub ecx, dword [ebp - 8]
inc edi
sar ecx, 1
add esi, 4
add edi, ecx
dec edx
test edx, edx
jg 0x4370be
mov dword [0x45fa34], edx
mov dword [0x45fa30], esi
mov dword [0x45fa24], edi
push 0x428980
push 0x428520
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
mov eax, dword [0x45fa24]
pop ecx
pop ecx
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.004355ef
xor edi, edi
mov dword [ebp - 4], eax
mov ebx, edi
mov esi, eax
cmp dword [0x45fa2c], ebx
jle 0x4371b1
mov ecx, dword [0x45fa24]
mov edi, esi
sub edi, eax
sar edi, 1
lea eax, [ecx + 1]
cmp edi, eax
jb 0x437165
mov ecx, 0x3f8
call fcn.0043b649
mov ecx, dword [0x45fa24]
mov eax, dword [0x45fa28]
sub ecx, edi
inc ecx
push dword [eax + ebx*4]
push ecx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov eax, dword [0x45fa28]
add esp, 0xc
xor edi, edi
mov ecx, dword [eax + ebx*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x437188
sub ecx, edx
sar ecx, 1
push 0x20
pop eax
push 2
lea esi, [esi + ecx*2]
mov word [esi], ax
pop eax
add esi, eax
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [0x45fa2c]
jl 0x437142
push eax
xor ecx, ecx
push 0x428544
mov word [esi - 2], cx
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
pop ecx
pop ecx
test eax, eax
je 0x4371d3
mov ecx, 0x3ec
call fcn.0043b649
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__wpgmptr]
push edi
push edi
push dword [0x45fa00]
push dword [eax]
push edi
call dword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnlp]
add esp, 0x14
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x438642
Capabilities:
Delete file
Terminate process

Disassembly:
cmp byte [0x45e9ff], 0
push esi
mov esi, ecx
jne 0x438653
call fcn.004385cb
test esi, esi
jne 0x43865c
mov esi, 0x428980
mov edx, esi
mov ecx, 0xfa8
pop esi
jmp fcn.0043b6c2

Function at 0x438669
Capabilities:
Delete file
Terminate process

Disassembly:
cmp byte [0x45e9c2], 0
push esi
mov esi, ecx
jne 0x438683
cmp byte [0x45e9ff], 0
jne 0x438683
call fcn.004385cb
test esi, esi
jne 0x43868c
mov esi, 0x428980
mov edx, esi
mov ecx, 0xfb2
pop esi
jmp fcn.0043b6c2
Function at 0x43afb9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
mov eax, esi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43b004
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, eax
test edx, edx
je 0x43b004
and esi, 0xf
je 0x43aff6
movzx eax, word [edx]
lea edx, [edx + eax*2]
add edx, 2
sub esi, 1
jne 0x43afe8
movzx eax, word [edx]
lea ecx, [edx + 2]
neg eax
pop esi
sbb eax, eax
and eax, ecx
ret
xor eax, eax
pop esi
ret
Function at 0x43b185
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x457904]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
mov eax, dword [0x45793c]
add eax, 4
mov dword [ebp - 0x220], ecx
imul eax, eax, 0x3e8
push ebx
mov ebx, edx
push esi
push edi
cmp ebx, eax
jge 0x43b383
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov esi, edi
call fcn.0043afb9
and dword [ebp - 0x214], 0
mov dword [ebp - 0x218], eax
test eax, eax
je 0x43b1f8
mov ecx, eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x43b1e6
sub ecx, edx
sar ecx, 1
lea esi, [ecx + edi]
mov edx, dword [0x45e64c]
test edx, edx
je 0x43b221
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x43b221
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x214]
jne 0x43b20c
sub ecx, edi
sar ecx, 1
add esi, ecx
add esi, 0x23
cmp esi, 0x100
jae 0x43b234
lea edi, [ebp - 0x204]
jmp 0x43b244
lea ecx, [esi + esi]
call fcn.0044c392
mov edx, dword [0x45e64c]
mov edi, eax
mov dword [ebp - 0x20c], esi
xor esi, esi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x208], esi
test edx, edx
je 0x43b282
cmp dword [edx + 8], esi
je 0x43b282
mov eax, dword [0x45794c]
push dword [eax + 0x20]
lea eax, [ebp - 0x210]
push dword [edx + 8]
push 0x428da4
push eax
call fcn.00454449
add esp, 0x10
jmp 0x43b295
lea eax, [ebp - 0x210]
push 0x428db4
push eax
call fcn.00454449
pop ecx
pop ecx
cmp ebx, 0xfa0
jl 0x43b2a4
mov eax, 0x428dc0
jmp 0x43b2b6
mov eax, 0x428dd0
cmp ebx, 0x7d0
jl 0x43b2b6
mov eax, 0x428de8
push dword [ebp - 0x218]
push ebx
push eax
lea eax, [ebp - 0x210]
push 0x428df4
push eax
call fcn.00454449
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x43b2fb
cmp dword [ebp - 0x20c], eax
jae 0x43b2e7
mov eax, dword [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
push 0x428e10
call fcn.00454460
add esp, 0xc
mov al, byte [0x45fa5a]
test al, al
jne 0x43b31b
push 0x428da0
call fcn.00454460
pop ecx
mov ecx, edi
call fcn.0044f718
mov al, byte [0x45fa5a]
cmp al, 1
jne 0x43b338
cmp ebx, 0x3ea
je 0x43b338
mov ecx, dword [ebp - 0x210]
mov edx, edi
sub ecx, edi
sar ecx, 1
call fcn.00447699
cmp byte [0x46ffd7], 0
je 0x43b383
cmp ebx, 0x3ec
jne 0x43b374
mov eax, dword [0x45e9c4]
test eax, eax
je 0x43b374
mov ecx, dword [0x46fdac]
test ecx, ecx
je 0x43b36c
call fcn.004409c5
mov eax, dword [0x45e9c4]
mov dword [0x46fdac], esi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
pop ecx
mov edx, dword [ebp - 0x220]
mov ecx, edi
call fcn.0043b008
jmp 0x43b385
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004553c5
leave
ret 8

Function at 0x43b6c2
Capabilities:
Delete file
Terminate process

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x43b6cb
sub esi, ecx
mov ecx, edi
sar esi, 1
push esi
call fcn.0043b396
cmp edi, 0x7d0
pop edi
pop esi
jl fcn.00438b10
ret
Function at 0x4425e3
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, dword [0x4715ac]
test eax, eax
jne 0x4425f4
mov eax, 0x4715b0
sub eax, 0xc
add eax, 0xc
mov dword [0x4715ac], eax
cmp eax, 0x4716a0
jb 0x442612
mov ecx, 0x3ef
call fcn.0043b649
jmp fcn.00438b10
push 0x20
pop ecx
call fcn.0044c392
mov ecx, dword [0x4715ac]
mov dword [ecx], eax
mov dword [ecx + 4], eax
add eax, 0x20
mov dword [ecx + 8], eax
ret

Function at 0x4540db
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, 0x811c9dc5
xor ecx, ecx
movsx eax, byte [ebp + ecx + 8]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x4540e5
mov eax, edx
xor edx, edx
div dword [0x45df84]
mov eax, edx
pop ebp
ret 4
Function at 0x10236e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10236bcb
out 0x76, al
mov dh, 0xb6
lea eax, [ebp - 0x58]
push eax
call fcn.10236bdb
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10236b90
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
Function at 0x10236f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10236bcb
sub al, 0xf1
cmp dh, bl
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10236bdb
push eax
push esi
push dword [ebp + 8]
call fcn.10236b90
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10236bdb
push eax
push esi
push dword [ebp + 8]
call fcn.10236b90
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10236bdb
push eax
push esi
push dword [ebp + 8]
call fcn.10236b90
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10236bcb
cmc
out dx, eax
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10236bcb
sub dh, byte [edi]
mov word [eax - 0x73], ss
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid