joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c994
Capabilities:
Get session user name

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
sub eax, eax
push ebp
push 0x43ca07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404024
mov dword [ebp - 8], 0x1e
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404670
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004044e4
push eax
call sub.advapi32.dll_GetUserNameA
or eax, eax
je 0x43c9f1
push ebx
mov ecx, dword [ebp - 8]
dec ecx
pushfd
xor edx, edx
inc edx
popfd
mov eax, dword [ebp - 4]
call fcn.00404544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ca0e
lea eax, [ebp - 4]
call fcn.00404024
ret

Function at 0x43ca14
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044d4
sub eax, eax
push ebp
push 0x43cb29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404024
xor ecx, ecx
push ebp
push 0x43cb09
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 4]
call fcn.00408224
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x43cafa
mov edx, dword [eax + 0xc]
or edx, edx
je 0x43cafa
mov esi, dword [edx]
or esi, esi
je 0x43cafa
push ebx
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
sub eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
sub eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x298], 0
lea edx, [ebp - 0x2b4]
push 3
pop ecx
pushal
popal
mov eax, 0x43cb40
call fcn.00408798
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cb13
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cb30
lea eax, [ebp - 4]
call fcn.00404024
ret
Function at 0x43cdd0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
mov ebx, eax
mov edx, ebx
mov eax, 0x43ce70
call fcn.0043e5bc
sub edx, edx
push ebp
push 0x43ce54
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
or eax, eax
jne 0x43ce45
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.wsock32.dll_inet_ntoa
push eax
pop edx
push ebx
pop eax
call fcn.0040421c
call sub.wsock32.dll_WSACleanup
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ce5e
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x43d7f0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
sub eax, eax
push ebp
push 0x43d8e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004042e4
cmp eax, 2
jl 0x43d8ce
mov eax, ebx
call fcn.00408008
test al, al
je 0x43d8ce
lea ecx, [ebp - 8]
mov edx, 0x43d904
mov eax, ebx
call fcn.0043d768
sub eax, eax
push ebp
push 0x43d8c4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.004044e4
push eax
pop esi
push esi
call sub.kernel32.dll_CreateFileA
push eax
pop ebx
cmp ebx, 0xffffffff
je 0x43d8ba
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004080b0
mov eax, dword [ebp - 0xc]
call fcn.004042e4
mov edi, eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
call fcn.0040453c
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileA
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43d8ce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d8f0
lea eax, [ebp - 0xc]
pushal
popal
push 2
pop edx
call fcn.00404048
ret
Function at 0x43da14
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
push eax
pop ebx
xor eax, eax
push ebp
push 0x43daeb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push ebx
pop eax
call fcn.004042e4
cmp eax, 2
jl 0x43dad5
sub eax, eax
push ebp
push 0x43dacb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push ebx
pop eax
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x43dac1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004080b0
mov eax, dword [ebp - 8]
call fcn.004042e4
push eax
pop edi
inc edi
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
call fcn.0040453c
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
call fcn.004044e4
push eax
call sub.kernel32.dll_DeleteFileA
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43dad5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43daf2
lea eax, [ebp - 8]
call fcn.00404024
ret

Function at 0x43dbf8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
push eax
pop ebx
mov eax, ebx
call fcn.00404024
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x43dc26
mov edx, ebx
lea eax, [esp + 4]
call fcn.004082f4
add esp, 0x18
pop ebx
ret
Function at 0x43e154
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffeb8
push ebx
push esi
push edi
push eax
pop esi
mov byte [ebp - 1], 0
sub ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
cmp edx, 0
jne 0x43e1a1
cmp eax, 0xffffffff
jne 0x43e1a1
mov byte [ebp - 1], 1
jmp 0x43e31e
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e1d0
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4e]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43e1d0
mov bl, 1
test bl, bl
jne 0x43e1dd
mov byte [ebp - 1], 1
jmp 0x43e31e
xor ebx, ebx
cmp word [ebp - 0x4e], 0x5a4d
je 0x43e1ed
cmp dword [ebp - 8], 0x40
jne 0x43e23f
push 0
push 0
mov eax, dword [ebp - 0x12]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e23f
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x146]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43e23f
mov eax, dword [ebp - 0x146]
cmp eax, 0x4550
je 0x43e23d
cmp eax, 0x454e
je 0x43e23d
cmp eax, 0x454c
jne 0x43e23f
mov bl, 1
test bl, bl
je 0x43e315
xor eax, eax
push ebp
push 0x43e30b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043e0ac
mov dword [ebp - 0x13e], eax
call fcn.00402ab0
nop
push 9
nop
pop eax
call fcn.00402ca8
mov word [ebp - reloc.crypt32.dll_CertGetStoreProperty], ax
nop
push 9
nop
pop eax
call fcn.00402ca8
mov word [ebp - 0x100], ax
push 0
push 0
mov eax, dword [ebp - 0x12]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e2c1
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x146]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp word [ebp - 0x4e], reloc.crypt32.dll_CertGetStoreProperty
je 0x43e301
mov word [ebp - 0xe], reloc.crypt32.dll_CertGetStoreProperty
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e301
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e315
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
sub ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
push eax
pop esi
xor eax, eax
push ebp
push 0x43e4c6
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
pop eax
call fcn.00404024
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004065bc
test eax, eax
je 0x43e4ad
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404294
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.0040c104
mov edx, dword [ebp - 0x110]
push ebx
pop eax
call fcn.00404078
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e4cd
lea eax, [ebp - 0x110]
call fcn.00404024
ret

Function at 0x43e538
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffef4
push ebx
sub edx, edx
mov dword [ebp - 0x10c], edx
push eax
pop ebx
xor eax, eax
push ebp
push 0x43e5b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404294
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c104
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.00404078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e5b7
lea eax, [ebp - 0x10c]
call fcn.00404024
ret

Function at 0x43e5bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
push edx
pop edi
mov dword [ebp - 4], eax
sub eax, eax
push ebp
push 0x43e636
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
pop eax
call fcn.00404024
mov eax, dword [ebp - 4]
call fcn.004042e4
mov esi, eax
or esi, esi
jle 0x43e620
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
push ebx
pop edx
call fcn.0040420c
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004042ec
inc dword [ebp - 8]
dec esi
jne 0x43e5f9
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e63d
lea eax, [ebp - 0xc]
call fcn.00404024
ret
Function at 0x43e860
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push eax
pop eax
push 6
pop ecx
push 0
push 0
dec ecx
jne 0x43e868
push ebx
push eax
pop ebx
sub eax, eax
push ebp
push 0x43ea04
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea edx, [ebp - 0x14]
mov eax, 0x43ea18
call fcn.0043e5bc
mov eax, dword [ebp - 0x14]
call fcn.004044e4
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp dword [ebp - 4], 0xff
jae 0x43e8bf
mov dword [ebp - 4], 0xaacd2aec
lea edx, [ebp - 0x10]
mov eax, 0x43ea24
call fcn.0043e5bc
mov eax, dword [ebp - 4]
push esi
pop esi
push 0x58
pop ecx
sub edx, edx
div ecx
xor edx, edx
push edx
push eax
mov edx, ebx
push ecx
pop ecx
push 8
pop eax
call fcn.00407bc8
push dword [ebx]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
shr eax, 4
movzx eax, ax
mov edx, 4
call fcn.00407ba0
push dword [ebp - 0x18]
push ebx
pop eax
mov edx, 3
call fcn.004043a4
push dword [ebx]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shr eax, 4
call fcn.00406568
movzx eax, ax
lea ecx, [ebp - 0x1c]
mov edx, 4
call fcn.00407ba0
push dword [ebp - 0x1c]
mov eax, ebx
push 3
pop edx
pushal
popal
call fcn.004043a4
push dword [ebx]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shr eax, 5
call fcn.00406568
movzx eax, ax
lea ecx, [ebp - 0x20]
pushal
popal
push 4
pop edx
call fcn.00407ba0
push dword [ebp - 0x20]
mov eax, ebx
nop
push 3
nop
pop edx
call fcn.004043a4
push dword [ebx]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shl eax, 6
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.00407bc8
push dword [ebp - 0x24]
push ebx
pop eax
push 3
pop edx
push esi
pop esi
call fcn.004043a4
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 4]
shr eax, 5
movzx eax, ax
push 4
pop edx
push edx
pop edx
call fcn.00407ba0
mov edx, dword [ebp - 0x28]
mov eax, ebx
call fcn.004042ec
lea edx, [ebp - 0x2c]
mov eax, 0x43ea30
call fcn.0043e5bc
push dword [ebp - 0x2c]
push dword [ebx]
lea edx, [ebp - 0x30]
mov eax, 0x43ea3c
call fcn.0043e5bc
push dword [ebp - 0x30]
push ebx
pop eax
push ebx
pop ebx
push 3
pop edx
call fcn.004043a4
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ea0b
lea eax, [ebp - 0x30]
mov edx, 9
call fcn.00404048
ret

Function at 0x43eb08
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push esp
pop eax
xor ecx, ecx
mov edx, 0x44
call fcn.00402c88
lea eax, [esp + 0x44]
xor ecx, ecx
push 0x10
pop edx
nop
nop
call fcn.00402c88
mov dword [esp], 0x44
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push edi
push 0
push 0x20
push 0
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret
Function at 0x43eb64
Capabilities:
Get file version info

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
push ecx
pop edi
mov dword [ebp - 4], edx
push eax
pop ebx
sub eax, eax
push ebp
push 0x43ecca
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, edi
call fcn.00404024
lea eax, [ebp - 0x24]
push eax
push ebx
pop eax
call fcn.004044e4
push eax
pop esi
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43eca7
mov eax, dword [ebp - 0xc]
call fcn.004026e8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
or eax, eax
je 0x43ec9f
xor eax, eax
push ebp
push 0x43ec95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x43ecd8
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
or eax, eax
je 0x43ec8b
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov edx, 4
call fcn.00407ba0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00406568
movzx eax, ax
lea ecx, [ebp - 0x18]
push 4
pop edx
push ecx
pop ecx
call fcn.00407ba0
push 0x43ecfc
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0x43ed18
lea eax, [ebp - 0x14]
nop
push 4
nop
pop edx
call fcn.004043a4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404330
mov eax, dword [ebp - 0x28]
call fcn.004044e4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
or eax, eax
je 0x43ec8b
mov eax, edi
mov edx, dword [ebp - 0x20]
call fcn.0040421c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ec9f
mov eax, dword [ebp - 8]
call fcn.00402708
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ecd1
lea eax, [ebp - 0x28]
call fcn.00404024
lea eax, [ebp - 0x1c]
push 3
pop edx
nop
nop
call fcn.00404048
ret
Function at 0x43f778
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov edi, eax
sub eax, eax
push ebp
push 0x43f873
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 8]
mov eax, 0x43f88c
call fcn.0043e5bc
lea eax, [ebp - 8]
push edi
pop edx
call fcn.004042ec
mov eax, dword [ebp - 8]
call fcn.004044e4
push eax
pop esi
xor edx, edx
push ebp
push 0x43f853
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x43f7f2
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f85d
mov eax, edi
call fcn.004044e4
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError
or eax, eax
jne 0x43f822
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f85d
push esi
push 0xffffffffffffffff
push 0
call fcn.004062c8
push eax
pop ebx
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x43f83f
cmp eax, 5
jne 0x43f849
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f85d
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f87a
lea eax, [ebp - 8]
call fcn.00404024
ret
Function at 0x43f894
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x150], ebx
push ecx
pop esi
mov dword [ebp - 4], edx
push eax
pop ebx
mov edi, dword [ebp + 8]
sub eax, eax
push ebp
push 0x43fa20
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dword [esi], 2
mov eax, edi
call fcn.00404024
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
pop eax
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43fa02
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43f9fc
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push ebx
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x43f9fc
cmp word [ebp - 0x50], reloc.crypt32.dll_CertGetStoreProperty
jne 0x43f9fc
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43f9fc
push 0
lea eax, [ebp - 0xc]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43f9fc
cmp dword [ebp - 0x148], 0x4550
jne 0x43f9fc
mov eax, dword [ebp - 0x140]
xor eax, 0x50485e00
xor eax, dword [ebp - 0x120]
movzx edx, word [ebp - reloc.crypt32.dll_CertGetStoreProperty]
xor eax, edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 2
jne 0x43f9af
call fcn.0043c774
add eax, 0x7c6
xor dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jle 0x43f9c9
cmp dword [ebp - 0x10], 0x7a120
jge 0x43f9c9
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov byte [ebp - 5], 1
jmp 0x43f9fc
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x10]
call fcn.00407a8c
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x43fa3c
call fcn.0043e5bc
mov edx, dword [ebp - 0x150]
mov eax, edi
pop ecx
call fcn.00404330
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fa27
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.00404048
ret
Function at 0x43fa6c
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffebc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x43fc2a
push dword fs:[eax]
mov dword fs:[eax], esp
sub ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x43fc0e
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x43fc08
cmp word [ebp - 0x4c], reloc.crypt32.dll_CertGetStoreProperty
jne 0x43fc08
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43fc08
cmp dword [ebp - 0x144], 0x4550
jne 0x43fc08
call sub.kernel32.dll_GetCurrentProcessId
add eax, 0x7c6
xor eax, dword [ebp - 0x13c]
mov dword [ebp - 0x13c], eax
call fcn.00402ab0
nop
push 9
nop
pop eax
call fcn.00402ca8
mov word [ebp - 0x100], ax
nop
push 9
nop
pop eax
call fcn.00402ca8
mov word [ebp - 0xfe], ax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fbac
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp byte [ebp - 1], 0
je 0x43fc08
mov eax, 0x200
call fcn.00402ca8
mov edi, eax
shl edi, 4
or edi, edi
jle 0x43fc08
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push edi
lea eax, [ebp - 0xc]
nop
nop
push 1
pop ecx
mov edx, dword [0x43fa48]
call fcn.004053ac
add esp, 4
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00406574
push 0
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fc31
lea eax, [ebp - 0xc]
mov edx, dword [0x43fa48]
call fcn.004053b8
ret
Function at 0x442670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push ecx
pop edi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4426ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404024
mov eax, dword [ebp - 4]
call fcn.004042e4
push eax
pop esi
or esi, esi
jle 0x4426d7
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040420c
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004042ec
inc dword [ebp - 0xc]
dec esi
jne 0x4426b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4426f4
lea eax, [ebp - 0x10]
call fcn.00404024
ret