joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dd00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4788f6
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4934d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc0], ecx
mov eax, dword [ebp - 0xc0]
movzx ecx, byte [eax]
cmp ecx, 1
jne 0x41dd46
xor al, al
jmp 0x41df38
push 0x47cca3
mov edx, dword [ebp + 0xc]
push edx
call fcn.00426cc0
add esp, 8
movzx eax, al
test eax, eax
je 0x41dd7e
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0xc0]
add ecx, 0x90
call fcn.004048a0
mov ecx, dword [ebp - 0xc0]
call fcn.0041da70
mov edx, dword [ebp - 0xc0]
mov byte [edx], 1
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x150], ecx
mov ecx, dword [ebp - 0xc0]
call fcn.0041e300
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 0xc0]
mov dword [edx + 0x108], eax
mov dword [ebp - 0xbc], 0
lea eax, [ebp - 0xbc]
push eax
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
push 0x41d680
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0xc0]
mov dword [edx + 0x104], eax
mov ecx, dword [ebp - 0xc0]
call fcn.0041dbc0
mov ecx, dword [ebp - 0xc0]
call fcn.0041ee50
movzx eax, al
test eax, eax
je 0x41deae
mov ecx, dword [ebp - 0xc0]
cmp dword [ecx + 0x104], 0
je 0x41deae
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x108], 0
je 0x41deae
push 0x47cca7
lea ecx, [ebp - 0x2c]
call fcn.00405820
mov dword [ebp - 4], 0
push 0x47ccb2
lea ecx, [ebp - 0x48]
call fcn.00405820
mov byte [ebp - 4], 1
push 0x47f6a8
lea ecx, [ebp - 0x64]
call fcn.00405820
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x64]
push edx
push 1
mov ecx, dword [ebp - 0xc0]
call fcn.0041f220
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00404600
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00404600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404600
jmp 0x41df36
push 0x47ccb3
lea ecx, [ebp - 0x80]
call fcn.00405820
mov dword [ebp - 4], 3
push 0x47ccc6
lea ecx, [ebp - 0x9c]
call fcn.00405820
mov byte [ebp - 4], 4
push 0x47f6b0
lea ecx, [ebp - 0xb8]
call fcn.00405820
mov byte [ebp - 4], 5
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0xb8]
push edx
push 1
mov ecx, dword [ebp - 0xc0]
call fcn.0041f220
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb8]
call fcn.00404600
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9c]
call fcn.00404600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00404600
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00453569
mov esp, ebp
pop ebp
ret 8
Function at 0x42bae0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], 0
mov dword [ebp - 4], 0
push 0x47ecfc
mov ecx, 0x49e334
call fcn.0040de70
cmp dword [ebp - 4], 0x14
jge 0x42bb5a
mov eax, dword [ebp + 8]
push eax
push 0x42a7f0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x47ed00
push 0x49e334
call fcn.00427270
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x42bb44
push 0x49e334
mov ecx, dword [ebp + 0xc]
call fcn.0041bec0
mov byte [ebp - 5], 1
jmp 0x42bb5a
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42bb03
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 8

Function at 0x42bb90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4934d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x238], 0x22c
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.00458400
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x42bbf2
xor eax, eax
jmp 0x42bc6b
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42bc46
lea ecx, [ebp - 0x214]
push ecx
push str.qq.exe
call fcn.00453f2d
add esp, 8
test eax, eax
jne 0x42bc2e
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x240], edx
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42bc0a
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x240], 0
jne 0x42bc65
mov eax, dword [ebp + 8]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453569
mov esp, ebp
pop ebp
ret 4
Function at 0x42e860
Capabilities:
Print debug messages
Send http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x4934d0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x170], ecx
push 0x120
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.00458400
add esp, 0xc
mov cx, word [ebp + 0xc]
mov word [ebp - 0x138], cx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x174]
add ecx, 1
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x174]
mov al, byte [edx]
mov byte [ebp - 0x179], al
add dword [ebp - 0x174], 1
cmp byte [ebp - 0x179], 0
jne 0x42e8bb
mov ecx, dword [ebp - 0x174]
sub ecx, dword [ebp - 0x178]
mov dword [ebp - 0x180], ecx
mov dx, word [ebp - 0x180]
mov word [ebp - 0x136], dx
xor eax, eax
jne 0x42e879
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0x184]
add eax, 1
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x184]
mov dl, byte [ecx]
mov byte [ebp - 0x189], dl
add dword [ebp - 0x184], 1
cmp byte [ebp - 0x189], 0
jne 0x42e922
mov eax, dword [ebp - 0x184]
sub eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
mov cx, word [ebp - 0x190]
mov word [ebp - 0xc0], cx
xor edx, edx
jne 0x42e901
mov dword [ebp - 0xcc], 0x47e380
mov eax, 1
mov word [ebp - 0xd0], ax
xor ecx, ecx
jne 0x42e964
mov edx, 0x1b
mov word [ebp - 0x18], dx
mov dword [ebp - 0x14], str.Access_Control_Allow_Origin
mov eax, 1
mov word [ebp - 0x16], ax
mov dword [ebp - 0x10], 0x47e3a0
mov ecx, 0x1c
mov word [ebp - 0xc], cx
mov dword [ebp - 8], str.Access_Control_Allow_Methods
mov edx, 0x1f
mov word [ebp - 0xa], dx
mov dword [ebp - 4], str.GET__PUT__POST__DELETE__OPTIONS
mov eax, 2
mov word [ebp - 0x130], ax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x12c], ecx
cmp dword [ebp + 0x14], 0
je 0x42ea07
mov dword [ebp - 0x168], 0
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x160], edx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x15c], eax
mov ecx, 1
mov word [ebp - 0x30], cx
lea edx, [ebp - 0x168]
mov dword [ebp - 0x2c], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x144]
push eax
push 0
lea ecx, [ebp - 0x140]
push ecx
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [edx + 0x10]
push ecx
mov edx, dword [ebp - 0x170]
mov eax, dword [edx]
push eax
call dword [sym.imp.HTTPAPI.dll_HttpSendHttpResponse]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x42ea55
push str.HttpSendHttpResponse_failed_with_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00453569
mov esp, ebp
pop ebp
ret 0x18
Function at 0x42ee50
Capabilities:
Register http server url

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.HTTPAPI.dll_HttpAddUrl]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ee81
xor al, al
jmp 0x42ee83
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x42f220
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42f24e
push 0x47e490
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
jmp 0x42f311
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x42f304
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov dx, word [ecx]
mov word [ebp - 0x1e], dx
add dword [ebp - 0x18], 2
cmp word [ebp - 0x1e], 0
jne 0x42f269
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
sar eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx + 8], 0
je 0x42f2ad
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00454e4f
add esp, 4
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004547a6
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
call fcn.00455f42
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
xor edx, edx
mov eax, dword [ebp - 8]
mov word [ecx + eax*2], dx
mov al, 1
jmp 0x42f311
push str.Error_during_path_adding._Wrong_path___directory_needed._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x42f570
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477216
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4934d0]
xor eax, ebp
mov dword [ebp - 0xc8], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x42f5ae
mov eax, 0x47cbe1
jmp 0x42f74d
push 1
lea ecx, [ebp - 0xc4]
call fcn.004310c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xe4]
call fcn.0040ddd0
mov byte [ebp - 4], 1
push 0x40
push 0x20
lea ecx, [ebp - 0xe4]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00431170
lea ecx, [ebp - 0xc4]
call fcn.00431230
movzx edx, al
test edx, edx
je 0x42f60a
push str.file_is_opened_successfully__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x42f649
push str.G:web_serverhtmlpage_not_found.html
lea ecx, [ebp - 0xe4]
call fcn.0040de70
push 0
push 0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0xc4]
call fcn.004321c0
push 0x40
push 0x20
lea edx, [ebp - 0xe4]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00431170
lea ecx, [ebp - 0xc4]
call fcn.00431210
mov dword [ebp - 0x10], eax
push 1
push 2
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.0042fe60
mov ecx, eax
call fcn.00424cc0
mov dword [ebp - 0xe8], eax
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 0
push 0
call fcn.00424c80
lea ecx, [ebp - 0x124]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0042fea0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x128]
push eax
call fcn.00454e4f
add esp, 4
mov ecx, dword [ebp - 0xe8]
add ecx, 2
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
call fcn.004547a6
add esp, 4
mov dword [ebp - 0x12c], eax
mov edx, dword [ebp - 0x12c]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xe8]
mov byte [eax], 0xd
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xe8]
mov byte [ecx + 1], 0xa
mov edx, dword [ebp - 0xe8]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0042fef0
lea ecx, [ebp - 0xc4]
call fcn.00431250
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x130], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe4]
call fcn.0040de50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.0042f770
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0xc8]
xor ecx, ebp
call fcn.00453569
mov esp, ebp
pop ebp
ret
Function at 0x432e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474958
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4934d0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x44], 0
je 0x432ec0
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x432ecc
mov al, 1
jmp 0x43306f
mov dword [ebp - 0x10], 8
call fcn.0041c450
push eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0041c450
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0041c400
add esp, 8
movzx eax, al
test eax, eax
je 0x432f0f
xor al, al
jmp 0x43306f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0042fa30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.00404980
mov ecx, eax
call fcn.00419720
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.0040deb0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.00404980
mov ecx, eax
call fcn.00419720
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx + 0x44]
call fcn.00435300
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x432f8a
cmp dword [ebp - 0x5c], 1
je 0x432f91
cmp dword [ebp - 0x5c], 3
je 0x43302b
jmp 0x433043
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00404980
mov ecx, eax
call fcn.00419720
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x432ff4
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00404980
mov ecx, eax
call fcn.00419720
push eax
call fcn.004559bd
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x432ff4
mov byte [ebp - 0x51], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404600
mov al, byte [ebp - 0x51]
jmp 0x43306f
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x433017
mov byte [ebp - 0x52], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404600
mov al, byte [ebp - 0x52]
jmp 0x43306f
cmp dword [ebp - 0x38], 0
jne 0x433029
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00426590
jmp 0x43305b
mov byte [ebp - 0x53], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404600
mov al, byte [ebp - 0x53]
jmp 0x43306f
mov byte [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404600
mov al, byte [ebp - 0x54]
jmp 0x43306f
jmp 0x432f22
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00453569
mov esp, ebp
pop ebp
ret
Function at 0x438890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x477159
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4934d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.00407ec0
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
call fcn.00408aa0
mov cl, byte [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov byte [esp + 0x14], 1
mov byte [esi + 0x28], cl
push edx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CryptoPP::HashFilter.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 0x24], eax
call fcn.004097a0
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 2
call fcn.004097a0
mov byte [esp + 0x14], 3
test edi, edi
jns 0x438925
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
jmp 0x438927
mov eax, edi
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x438939
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov dword [esi + 0xc], ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x18

Function at 0x43b0c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477060
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x4934d0]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push edi
mov eax, dword [0x4934d0]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
lea eax, [esp + 0x60]
push eax
mov edi, edx
call fcn.0043afd0
mov ebx, eax
push 0x486ff8
lea ecx, [esp + 0x30]
push edi
push ecx
mov dword [esp + 0x98], 0
call fcn.004358b0
mov edi, eax
lea edx, [esp + 0x1c]
push edx
mov eax, ebx
mov byte [esp + 0x9c], 1
call fcn.0043aed0
push str._is_not_a_valid_key_length
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0xa8], 2
call fcn.0040c3d0
add esp, 0x20
push eax
mov ecx, esi
mov byte [esp + 0x8c], 3
call fcn.004068f0
lea ecx, [esp + 0x44]
call fcn.00404600
lea ecx, [esp + 0xc]
call fcn.00404600
lea ecx, [esp + 0x28]
call fcn.00404600
lea ecx, [esp + 0x60]
call fcn.00404600
mov dword [esi], vtable.CryptoPP::InvalidKeyLength.0
mov eax, esi
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00453569
add esp, 0x80
ret
Function at 0x43b1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
mov esi, eax
call fcn.0040c7c0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x43b1f2
test ecx, ecx
je 0x43b1dd
lea eax, [ecx - 1]
test ecx, eax
jne 0x43b1dd
and eax, edi
jmp 0x43b1e5
mov eax, edi
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x43b2a1
push 0
call fcn.0040c7c0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x43b227
test ecx, ecx
je 0x43b212
lea eax, [ecx - 1]
test ecx, eax
jne 0x43b212
and eax, ebp
jmp 0x43b21a
mov eax, ebp
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x43b2a1
push 0
call fcn.0040c7c0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x43b258
test ecx, ecx
je 0x43b247
lea eax, [ecx - 1]
test ecx, eax
jne 0x43b247
and eax, esi
jmp 0x43b24f
mov eax, esi
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x43b2a1
mov edx, dword [esp + 0x18]
mov ecx, edx
push ebx
shr ecx, 2
xor ebx, ebx
test ecx, ecx
je 0x43b28d
mov edx, ebp
sub edx, esi
mov eax, esi
sub edi, esi
mov ebx, ecx
mov ebp, dword [edx + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x43b272
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
lea eax, [ebx*4]
sub edx, eax
pop ebx
je 0x43b2c0
add edi, eax
add ebp, eax
add esi, eax
jmp 0x43b2a5
mov edx, dword [esp + 0x18]
test edx, edx
je 0x43b2c0
mov ecx, ebp
sub ecx, esi
mov eax, esi
sub edi, esi
mov esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec esi
mov byte [eax + edi - 1], dl
jne 0x43b2b3
pop edi
pop esi
pop ebp
ret

Function at 0x43b2d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
push 0
xor bl, bl
call fcn.0040c7c0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x43b317
test ecx, ecx
je 0x43b302
lea eax, [ecx - 1]
test ecx, eax
jne 0x43b302
and eax, esi
jmp 0x43b30a
mov eax, esi
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x43b3a5
push 0
call fcn.0040c7c0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x43b348
test ecx, ecx
je 0x43b337
lea eax, [ecx - 1]
test ecx, eax
jne 0x43b337
and eax, ebp
jmp 0x43b33f
mov eax, ebp
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x43b3a5
mov ecx, edi
shr ecx, 2
xor edx, edx
xor ebx, ebx
test ecx, ecx
je 0x43b375
mov eax, ebp
sub esi, ebp
mov ebx, ecx
jmp 0x43b360
mov edi, dword [esi + eax]
xor edi, dword [eax]
add eax, 4
or edx, edi
dec ecx
jne 0x43b360
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea eax, [ebx*4]
sub edi, eax
jne 0x43b38c
pop edi
pop esi
xor eax, eax
test edx, edx
pop ebp
sete al
pop ebx
ret
mov ebx, edx
shr ebx, 0x18
mov ecx, edx
shr ecx, 0x10
or bl, cl
mov ecx, edx
shr ecx, 8
or bl, cl
add esi, eax
add ebp, eax
or bl, dl
test edi, edi
je 0x43b3bb
mov eax, ebp
sub esi, ebp
lea ecx, [ecx]
mov dl, byte [eax + esi]
xor dl, byte [eax]
inc eax
or bl, dl
dec edi
jne 0x43b3b0
pop edi
pop esi
xor eax, eax
test bl, bl
pop ebp
sete al
pop ebx
ret
Function at 0x43c790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x477610
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x4934d0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov byte [esp + 0x14], 1
call fcn.004075a0
mov esi, dword [ebp + 8]
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x14]
push ecx
push 0x495b84
push eax
mov ecx, esi
call edx
call fcn.004075b0
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x18]
push ecx
push 0x495ad8
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x48
call edx
mov al, byte [esp + 0x14]
mov edi, 0x4871a0
test al, al
jne 0x43c812
mov edi, 0x485ef1
movzx eax, al
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
lea ecx, [ebx + 0x44]
mov dword [esp + 0x1c], 6
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0x47e210
call fcn.0044cc20
push 0
push edi
lea ecx, [esp + 0x64]
mov ebx, eax
call fcn.004075c0
mov dword [esp + 0x20], eax
push 0
push edi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x88], 0
call fcn.004075c0
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
push str.EncodingLookupArray
push edx
mov byte [esp + 0x8c], 1
call fcn.0043c9b0
add esp, 0xc
mov byte [esp + 0x80], 2
movzx ecx, byte [eax + 8]
push ecx
push str.PaddingByte
mov edi, eax
call fcn.0043cb30
lea edx, [esp + 0x1c]
push 1
push edx
mov edi, eax
call fcn.00407580
push eax
mov eax, dword [esp + 0x2c]
push eax
call fcn.00407550
mov ecx, dword [esp + 0x34]
push eax
push ecx
call fcn.00407540
push eax
lea edx, [esp + 0x44]
push edx
call fcn.00407570
push eax
mov ecx, edi
call fcn.0040c5b0
mov ecx, eax
call fcn.0040c670
mov ecx, eax
call fcn.0040c670
mov ecx, eax
call fcn.0040cb30
mov dword [esp + 0x2c], vtable.CryptoPP::CombinedNameValuePairs.0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], eax
mov byte [esp + 0x80], 3
mov eax, dword [ebx]
mov edx, dword [eax + 0x28]
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebx
call edx
lea ecx, [esp + 0x2c]
call fcn.0041ced0
lea ecx, [esp + 0x38]
mov byte [esp + 0x80], 1
call fcn.004081a0
lea ecx, [esp + 0x44]
call fcn.00408180
lea ecx, [esp + 0x5c]
call fcn.00408180
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43d230
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x43d240
movzx edx, byte [esi + 0x47d728]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x49d8e0], edx
mov dword [esi*8 + 0x49d8e4], eax
inc esi
cmp esi, 0x100
jl 0x43d240
mov dword [0x49e0e8], edi
mov dword [0x49e0ec], edi
mov dword [0x49e0e0], edi
mov dword [0x49e0e4], edi
pop edi
pop esi
mov byte [0x49e0f9], 1
pop ebx
ret