joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062ab
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00406287
pop esi
leave
ret 8

Function at 0x40725d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40729c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40729c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40729c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40729c
cmp dword [ecx + 0x74], 0xe
jbe 0x40729c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x22a15e3b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x6d342755
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40cb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40cb5f
pop dword [ebp - 0xc]
mov eax, 0xc3579393
sub eax, 0xc316c834
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x34a32
push 0
mov eax, 0xcce63687
add eax, 0x335aaa51
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x9d68ff48
sub ecx, 0x9d68c9b0
mov esi, eax
mov edx, 0x413bc4
add edx, dword [ebp - 0xc]
mov ebx, 0xbf0e4b26
mov dword [ebp - 4], 0x7d7b4e8
mov edi, dword [edx]
xor dword [ebp - 4], edx
add edi, ebx
sub dword [ebp - 4], ecx
mov dword [esi], edi
xor dword [ebp - 8], eax
add esi, 4
add edx, 0x1b663b86
add edx, 0xe499c47e
loop 0x40cbb2
add eax, 0xc933
mov ebx, eax
add eax, 5
mov ecx, 0xe8d02ab8
sub ecx, 0xe8902ab8
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x40d673
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40d6a4
call fcn.00403763
mov dword [eax], esi
call fcn.00403750
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040cb50
add esp, 0x14
push 0x16
pop eax
jmp 0x40d6f9
test dword [ebp + 0xc], 0xfffffff9
jne 0x40d680
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40d6d1
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.0040cb50
pop ecx
call fcn.00403750
mov eax, dword [eax]
jmp 0x40d6f9
test al, 0x10
jne 0x40d6f7
test al, 1
je 0x40d6f7
test byte [ebp + 0xc], 2
je 0x40d6f7
call fcn.00403763
mov dword [eax], 5
call fcn.00403750
mov dword [eax], 0xd
jmp 0x40d6c8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x401126
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x40112c
Capabilities:
Identify system language via api
Terminate process

Disassembly:
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [esp + 2], ax
mov dword [esp + 4], 0x78a13529
mov eax, 0x78a13529
cmp eax, 0xaeaab18d
je 0x4011bf
cmp eax, 0x78a13529
je 0x401164
cmp eax, 0xb8b656b8
jne 0x401147
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movsx eax, word [esp + 2]
cmp eax, 0x43e
jle 0x40118d
movsx ecx, ax
cmp ecx, 0x818
jg 0x4011a7
add eax, 0xfffffbc1
cmp ax, 4
ja 0x4011bf
mov ecx, 0x13
jmp 0x4011a0
add eax, 0xfffffbe7
cmp ax, 0x13
ja 0x4011bf
movzx eax, ax
mov ecx, 0xc8401
bt ecx, eax
jae 0x4011bf
jmp 0x40115c
movzx eax, ax
cmp eax, 0x819
je 0x40115c
cmp eax, 0x843
je 0x40115c
cmp eax, 0x82c
je 0x40115c
add esp, 8
ret

Function at 0x401234
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push 0x4662c8
push ecx
call fcn.0044e695
add esp, 8
xor esi, esi
test eax, eax
je 0x4012c1
mov edi, eax
push 2
push 0
push eax
call fcn.0044cacd
add esp, 0xc
push edi
call fcn.0044ce1c
add esp, 4
test eax, eax
js 0x4012b8
mov ebp, eax
push edi
call fcn.0045045c
add esp, 4
lea eax, [ebp + 1]
push eax
call dword [0x472054]
add esp, 4
test eax, eax
je 0x4012b8
mov ebx, eax
push edi
push ebp
push 1
push eax
call fcn.0044fb49
add esp, 0x10
test eax, eax
je 0x4012a6
mov ebp, eax
push edi
call fcn.0044f4a3
add esp, 4
test eax, eax
je 0x4012c8
push edi
call fcn.0044f31e
add esp, 4
push ebx
call dword [0x472050]
jmp 0x4012be
push edi
call fcn.0044f31e
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.0044f31e
add esp, 4
mov byte [ebx + ebp], 0
mov esi, ebx
jmp 0x4012c1

Function at 0x402389
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
test edx, edx
je 0x4023b1
mov edi, 0x1505
xor esi, esi
movzx ebx, byte [ecx + esi]
test ebx, ebx
je 0x4023b8
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp edx, esi
jne 0x402397
jmp 0x4023ba
mov eax, 0x1505
jmp 0x4023ba
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x40c038
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebp, dword [esp + 0x6c]
mov edx, dword [esp + 0x68]
mov edi, esp
mov ecx, 5
mov esi, 0x466620
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0x40
jb 0x40c0b8
shr ebp, 6
xor ebx, ebx
mov esi, edx
xor edi, edi
movzx eax, byte [esi + edi]
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + edi + 0x14], ecx
movzx eax, byte [esi + edi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + edi + 0x14], ecx
add edi, 4
cmp edi, 0x40
jne 0x40c063
mov ecx, esp
lea edx, [esp + 0x14]
call fcn.0040c152
inc ebx
lea edx, [esi + edi]
cmp ebx, ebp
jne 0x40c05f
add esi, edi
mov edx, esi
mov ebp, dword [esp + 0x6c]
xor ebx, ebx
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov esi, ebp
and esi, 0x3f
je 0x40c0ec
xor eax, eax
movzx edi, byte [edx + eax]
mov ecx, ebx
and cl, 0x18
shl edi, cl
mov ecx, eax
and ecx, 0xfffffffc
xor dword [esp + ecx + 0x14], edi
inc eax
add ebx, 8
cmp esi, eax
jne 0x40c0d0
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
xor eax, eax
inc eax
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x14], eax
cmp esi, 0x38
jb 0x40c124
mov ecx, esp
lea edi, [esp + 0x14]
mov edx, edi
call fcn.0040c152
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x70]
lea edx, [esp + 0x14]
mov dword [edx + 0x38], ebx
shr ebp, 0x1d
mov dword [edx + 0x3c], ebp
mov ecx, esp
call fcn.0040c152
xor eax, eax
mov ecx, dword [esp + eax*4]
mov dword [esi + eax*4], ecx
inc eax
cmp eax, 5
jne 0x40c13e
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4132dc
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x4133db
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4133d4
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebp, esi
sub ebp, eax
xor edx, edx
cmp ebp, 8
mov dword [esp], esi
jb 0x413385
xor esi, esi
mov eax, esi
movzx edx, byte [ebx + esi]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + esi + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea esi, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x413325
mov edx, ebp
and edx, 0x1ff8
add ebx, esi
mov esi, dword [esp]
mov eax, ebp
sub eax, edx
jbe 0x41339f
xor edx, edx
movzx esi, byte [ebx + edx]
add edi, esi
add ecx, edi
inc edx
cmp eax, edx
jne 0x41338d
add ebx, eax
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, ebp
mov ebp, 0x15b0
jne 0x413319
shl ecx, 0x10
or ecx, edi
jmp 0x4133de
xor ecx, ecx
inc ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4133e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
not ebx
cmp ecx, 4
jb 0x41345d
mov eax, 0xff
mov esi, ebx
shr esi, 8
movzx edi, byte [edx]
and ebx, eax
xor ebx, edi
xor esi, dword [ebx*4 + 0x466840]
mov edi, esi
shr edi, 8
movzx ebx, byte [edx + 1]
and esi, eax
xor esi, ebx
xor edi, dword [esi*4 + 0x466840]
mov esi, edi
shr esi, 8
movzx ebx, byte [edx + 2]
and edi, eax
xor edi, ebx
xor esi, dword [edi*4 + 0x466840]
mov ebx, esi
shr ebx, 8
movzx edi, byte [edx + 3]
and esi, eax
xor esi, edi
xor ebx, dword [esi*4 + 0x466840]
add edx, 4
add ecx, 0xfffffffc
cmp ecx, 3
ja 0x413403
test ecx, ecx
je 0x413481
xor esi, esi
mov eax, ebx
shr eax, 8
movzx edi, byte [edx + esi]
movzx ebx, bl
xor ebx, edi
xor eax, dword [ebx*4 + 0x466840]
inc esi
mov ebx, eax
cmp ecx, esi
jne 0x413465
jmp 0x413483
mov eax, ebx
not eax
pop esi
pop edi
pop ebx
ret

Function at 0x413584
Capabilities:
Compute adler32 checksum

Disassembly:
mov ecx, dword [esp + 4]
mov edx, ecx
cmp ecx, 0xa
jl 0x413594
mov edx, 0xa
test ecx, ecx
jns 0x41359d
mov edx, 6
xor eax, eax
cmp ecx, 4
setl al
shl eax, 0xe
or eax, dword [edx*4 + 0x466c90]
cmp dword [esp + 8], 0
jle 0x4135bb
or eax, 0x1000
test ecx, ecx
je 0x4135d6
mov ecx, dword [esp + 0xc]
dec ecx
cmp ecx, 3
ja case.default.0x4135c9
jmp dword [ecx*4 + 0x4681b0]
or eax, 0x20000
ret
or eax, 0x80000
ret
and eax, 0xfffff000
ret
or eax, 0x10000
ret
or eax, 0x40000
ret
Function at 0x4176e3
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
call fcn.0044ce4c
add esp, 4
mov ecx, dword [esi + 0x48]
mov edi, dword [ecx + 0x40]
add edi, dword [esp + 0x14]
mov ebx, dword [ecx + 0x44]
adc ebx, dword [esp + 0x18]
js 0x417726
xor eax, edi
xor edx, ebx
or edx, eax
je 0x41772d
push 0
push ebx
push edi
push dword [ecx + 0x3c]
call fcn.0044cb07
add esp, 0x10
test eax, eax
je 0x41772a
xor eax, eax
jmp 0x417742
mov ecx, dword [esi + 0x48]
push dword [ecx + 0x3c]
push dword [esp + 0x24]
push 1
push dword [esp + 0x28]
call fcn.0044fb49
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x41c393
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41c499
mov esi, dword [ebp + 0xc]
mov eax, 0xfffffff6
cmp dword [ebx + 0x10], esi
jbe 0x41c4b1
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx]
test eax, eax
je 0x41c49e
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + esi*4]
lea edi, [eax + ecx]
add edi, 0x2e
movzx edx, word [edi - 0x12]
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x41c3fa
push eax
mov dword [esp + 8], edx
call fcn.0044fd4c
mov edx, dword [esp + 8]
add esp, 4
mov dword [ebx + 0x5c], 0
mov ecx, edi
call fcn.0041c4b9
mov dword [ebx + 0x5c], eax
test eax, eax
je 0x41c4a5
lea eax, [esp + 8]
push eax
push esi
push ebx
call fcn.0041837e
add esp, 0xc
test eax, eax
je 0x41c4ac
mov dword [ebx + 0x58], esi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [ebx + 0x6c], ecx
mov dword [ebx + 0x68], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov dword [ebx + 0x60], ecx
mov dword [ebx + 0x64], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x70], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0x7c], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [ebx + 0xa4], ecx
mov dword [ebx + 0xa0], eax
movzx eax, word [esp + 0x1e]
mov word [ebx + 0xa8], ax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
mov dword [ebx + 0x4e008], ecx
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0x4e014], eax
mov dword [ebx + 0x4e010], ecx
xor eax, eax
jmp 0x41c4b1
xor eax, eax
dec eax
jmp 0x41c4b1
mov eax, 0xfffffff5
jmp 0x41c4b1
mov eax, 0xfffffffe
jmp 0x41c4b1
mov eax, 0xfffffffd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41c7d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2040
call fcn.00441b10
cmp dword [ebp + 8], 0
je 0x41c878
mov esi, dword [ebp + 0xc]
lea ebx, [esp + 0x3c]
push 0x2000
push 0
push ebx
call fcn.00444cd0
add esp, 0xc
mov edx, esp
xor eax, eax
mov ecx, 0xe
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.0041bdf3
mov edi, 0xfffffffd
test eax, eax
jne 0x41c88f
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edi, dword [ebp + 8]
mov dword [edi + 0x4e010], eax
mov dword [edi + 0x4e014], ecx
mov ecx, esi
mov edx, 0x467c75
call fcn.0041769f
test eax, eax
je 0x41c87d
mov esi, eax
push esi
push 0x2000
push 1
push ebx
call fcn.0044fb49
add esp, 0x10
test eax, eax
je 0x41c884
push eax
push ebx
push edi
call fcn.0041c745
add esp, 0xc
test eax, eax
jns 0x41c84d
mov edi, 0xfffffff8
jmp 0x41c886
xor edi, edi
dec edi
jmp 0x41c88f
mov edi, 0xfffffff0
jmp 0x41c88f
xor edi, edi
push esi
call fcn.0044f31e
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422642
Capabilities:
Create directory

Disassembly:
push edi
push esi
call fcn.00422243
mov esi, eax
push eax
call fcn.0044e942
add esp, 4
mov edi, eax
push esi
call fcn.0044fd4c
add esp, 4
mov eax, edi
pop esi
pop edi
ret
Function at 0x4240b3
Capabilities:
Get disk information

Disassembly:
push esi
push eax
xor eax, eax
mov esi, esp
mov dword [esi], eax
push eax
push eax
push eax
push eax
push esi
push eax
push eax
push 0x46831a
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [esi]
add esp, 4
pop esi
ret

Function at 0x425086
Capabilities:
Get hostname

Disassembly:
push edi
push esi
push eax
mov eax, 0x400
mov edi, esp
mov dword [edi], eax
push eax
call fcn.004500f4
add esp, 4
mov esi, eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov eax, esi
add esp, 4
pop esi
pop edi
ret
Function at 0x42fc00
Capabilities:
Create process on windows
Query environment variable
Resolve function by parsing pe exports

Disassembly:
call fcn.0040a95c
call fcn.0040112c
call fcn.0041f66b
jmp fcn.00427de0
Function at 0x433e90
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaa0
mov esi, esp
mov dword [esi + 0x28], 0x81fa5c77
mov eax, 0x81fa5c77
xor ebx, ebx
cmp eax, 0x4774cb4
jle 0x433ef3
cmp eax, 0x3cf3a763
jg 0x433f3a
cmp eax, 0x4774cb5
je 0x433f97
cmp eax, 0x20baa0c4
je 0x433fb3
cmp eax, 0x2af00f3c
jne 0x433eaf
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
add eax, 0x67
mov dword [esi + 0x30], eax
mov eax, 0xb9cab840
jmp 0x433eaf
cmp eax, 0xb9cab83f
jle 0x433f77
cmp eax, 0xb9cab840
je 0x433fed
cmp eax, 0xe67b9927
je 0x434037
cmp eax, 0xe95f12ee
jne 0x433eaf
lea eax, [esi + 8]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x18], eax
mov eax, 0x4443c68a
jmp 0x433eaf
cmp eax, 0x3cf3a764
je 0x434041
cmp eax, 0x4162420e
je 0x434066
cmp eax, 0x4443c68a
jne 0x433eaf
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
add eax, 0xffffffff
adc ecx, 0xffffffff
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov eax, 0x3cf3a764
jmp 0x433eaf
cmp eax, 0x81fa5c77
je 0x434070
cmp eax, 0x9e2a8d5b
jne 0x43407a
mov eax, 0xe67b9927
jmp 0x433eaf
imul eax, dword [esi + 0x2c], 0x22800
or eax, 0xc1
lea eax, [eax + eax*2]
mov dword [esi + 0x2c], eax
mov eax, 0x9e2a8d5b
jmp 0x433eaf
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
lea edi, [esi + 0x9c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x14], eax
mov eax, 0x4774cb5
jmp 0x433eaf
mov eax, dword [esi + 0x30]
mov byte [eax], 0
mov edi, 0x67
push edi
push 0x474010
push dword [esi + 4]
call fcn.004441d0
add esp, 0xc
push 6
push 0x474077
push edi
push dword [esi + 4]
call fcn.004340c0
add esp, 0x10
push 0x68
push dword [esi + 4]
lea eax, [esi + 0x34]
push eax
call fcn.004441d0
add esp, 0xc
mov eax, 0x9f55d049
jmp 0x433eaf
mov eax, 0xe95f12ee
jmp 0x433eaf
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [esi + 0xc], ecx
mov dword [esi + 8], eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, 0x4162420e
jmp 0x433eaf
mov eax, 0x2af00f3c
jmp 0x433eaf
mov eax, 0x20baa0c4
jmp 0x433eaf
cmp eax, 0x9f55d049
jne 0x433eaf
mov dword [esi + 0x28], eax
lea ebx, [esi + 0x29c]
lea eax, [esi + 0x9c]
push eax
push eax
push dword [esi + 8]
lea eax, [esi + 0x34]
push eax
push 0x800
push ebx
call fcn.00425c83
add esp, 0x18
xor edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x43b3d4
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
push esi
call fcn.00450770
add esp, 4
mov dword [esp + 0xc], eax
xor ebp, ebp
lea eax, [esp + 8]
push ebp
push ebp
push eax
push ebp
push 1
push dword [esp + 0x20]
push esi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x78a13529
mov ecx, 0x78a13529
mov esi, dword [esp + 0x14]
mov edi, 0xfffffe4e
cmp ecx, 0x1249dc0a
jle 0x43b454
cmp ecx, 0x3de22965
jle 0x43b4a6
cmp ecx, 0x6a667c0e
jg 0x43b531
cmp ecx, 0x3de22966
je 0x43b555
cmp ecx, 0x626988b8
jne 0x43b41d
mov ecx, 0xa5ae260f
jmp 0x43b41d
cmp ecx, 0xb2a1aad1
jg 0x43b4f9
cmp ecx, 0x9978191a
je 0x43b56b
cmp ecx, 0xa5ae260f
je 0x43b59d
cmp ecx, 0xaeaab18d
jne 0x43b41d
push dword [esp + 0x20]
call fcn.004500f4
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov byte [ecx + eax], 0
mov ecx, 0xc275a18f
jmp 0x43b41d
cmp ecx, 0x1249dc0b
je 0x43b5af
cmp ecx, 0x1e35e006
je 0x43b5b9
cmp ecx, 0x327a55ad
jne 0x43b41d
mov eax, dword [esp]
add eax, 0xffffffd8
shr eax, 7
lea ecx, [eax - 0x58]
imul eax, eax
shr ecx, 2
imul edx, eax, 0x4a85
dec edx
imul ecx, ecx, 0x3c
mov dword [esp], ecx
mov ecx, 0xaeaab18d
cmp eax, edx
je 0x43b54e
mov ecx, 0x6a667c0f
jmp 0x43b54e
cmp ecx, 0xb2a1aad2
je 0x43b5d1
cmp ecx, 0xb8b656b8
je 0x43b5ff
cmp ecx, 0xc275a18f
jne 0x43b41d
imul eax, dword [esp], 0x44000
mov dword [esp], eax
mov ecx, 0x1249dc0b
jmp 0x43b41d
cmp ecx, 0x78a13529
jne 0x43b61a
cmp dword [esp + 0x1c], 0
mov ecx, 0x6a667c0f
je 0x43b54e
mov ecx, 0xb8b656b8
xor esi, esi
jmp 0x43b41d
push dword [esp + 4]
call fcn.0044fd4c
add esp, 4
mov ecx, 0x327a55ad
jmp 0x43b41d
push ebp
push ebp
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 1
push dword [esp + 0x20]
push dword [esp + 0x54]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov ecx, 0x3de22966
test eax, eax
je 0x43b41d
mov ecx, 0x626988b8
jmp 0x43b41d
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, 0xb2a1aad2
jmp 0x43b41d
mov ecx, 0x9978191a
jmp 0x43b41d
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x40]
mov dword [ecx], eax
mov ecx, 0x6a667c0f
mov esi, dword [esp + 4]
jmp 0x43b41d
mov eax, dword [esp]
add eax, edi
mov edx, eax
imul edx, eax
imul ebx, edx, 0xceb
dec ebx
shr eax, 7
mov dword [esp], eax
mov ecx, 0xa5ae260f
cmp ebx, edx
je 0x43b41d
mov ecx, 0x1e35e006
jmp 0x43b41d
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x20], eax
mov ecx, 0xaeaab18d
jmp 0x43b41d
cmp ecx, 0x6a667c0f
jne 0x43b41d
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44212f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44216e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44216e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44216e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44216e
cmp dword [ecx + 0x74], 0xe
jbe 0x44216e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44be99
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044c0f0
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x44c011
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x44c011
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x44bfc0
jg 0x44bef2
test eax, eax
je 0x44bfb6
push 1
push 0x1000
call fcn.00458010
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44bf18
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x44bfad
push 0x8000
push ebx
call fcn.0044e29c
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x44bf44
jg 0x44bf3f
cmp ecx, 0x1000
jb 0x44bf44
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004580a4
add esp, 0x10
cmp eax, 0xffffffff
je 0x44bf89
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x44bf3f
jl 0x44bf70
test ecx, ecx
jne 0x44bf31
push dword [ebp - 0xc]
push ebx
call fcn.0044e29c
push esi
call fcn.00455f04
add esp, 0xc
xor edi, edi
jmp 0x44c022
cmp byte [edi + 0x24], 0
je 0x44bfa0
cmp dword [edi + 0x20], 5
jne 0x44bfa0
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x44bfab
mov edi, dword [edi + 0x18]
jmp 0x44bfad
xor edi, edi
push esi
call fcn.00455f04
pop ecx
jmp 0x44c022
test ecx, ecx
jg 0x44bf82
jl 0x44bfc0
test eax, eax
jae 0x44bf82
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00458b9a
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x44bfe3
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x44bf82
jmp 0x44c01a
push ebx
call fcn.00457bdc
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x44bf82
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x44c022
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x44c01f
mov edi, dword [edi + 0x18]
jmp 0x44c022
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00458b9a
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret