joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45309694
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x453618d7
call fcn.4534228c
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 7
call sym.HHA.dll_Ordinal_35
mov dword [esi + 0xac], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
or dword [esi + 0xcc], 0xffffffff
push 0x64
pop eax
mov byte [ebp - 4], 0x14
push 0x45364214
mov dword [esi + 0xd0], 0x200
mov dword [esi + 0xd4], 0x800035
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi], 0x1d955
mov dword [esi + 0xa4], edi
mov dword [esi + 0xb8], edi
call sym.HHA.dll_Ordinal_23
mov ebx, eax
mov eax, dword [esi + 8]
cmp eax, edi
je 0x4530977b
push eax
call fcn.45341e40
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1c], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x38], edi
mov dword [esi + 8], ebx
mov dword [esi + 0x30], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x45311b4e
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4536e110]
push esi
cmp eax, 0xffffffff
push edi
jne 0x45311be9
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
push eax
call sym.HHA.dll_Ordinal_80
mov edi, str.mapi32.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x45311bcc
push 1
pop eax
jmp 0x45311be4
xor eax, eax
push eax
push eax
push eax
push eax
push str.MAPI32.DLL
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathA]
neg eax
sbb eax, eax
neg eax
mov dword [0x4536e110], eax
pop edi
pop esi
leave
ret
Function at 0x4531b828
Capabilities:
Delete file

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x43c], ebx
lea eax, [esi + 0x43c]
jne 0x4531b95e
mov dword [eax], 1
call fcn.4531b963
mov edi, dword [esi + 0x6f0]
cmp edi, ebx
je 0x4531b86b
mov ecx, edi
call fcn.4532297a
push edi
call fcn.45341eb0
pop ecx
mov dword [esi + 0x6f0], ebx
mov edi, dword [esi + 0x4cc]
cmp edi, ebx
je 0x4531b883
mov ecx, edi
call fcn.45322c07
push edi
call fcn.45341eb0
pop ecx
mov edi, dword [esi + 0x484]
lea ebp, [esi + 0x484]
cmp edi, ebx
je 0x4531b8a2
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [ebp], ebx
mov eax, dword [esi + 0x478]
lea edi, [esi + 0x478]
cmp eax, ebx
je 0x4531b8ba
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
mov eax, dword [esi + 0x47c]
lea edi, [esi + 0x47c]
cmp eax, ebx
je 0x4531b8d2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
mov edi, dword [esi + 0x480]
lea ebp, [esi + 0x480]
cmp edi, ebx
je 0x4531b8f1
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [ebp], ebx
mov edi, dword [esi + 0x4d0]
cmp edi, ebx
je 0x4531b90f
mov ecx, edi
call fcn.45320423
push edi
call fcn.45341eb0
pop ecx
mov dword [esi + 0x4d0], ebx
mov eax, dword [esi + 0x494]
lea edi, [esi + 0x494]
cmp eax, ebx
je 0x4531b927
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
cmp byte [esi + 0x6f4], bl
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esi + 0x6f4]
je 0x4531b93e
push eax
call edi
cmp byte [esi + 0x4e8], bl
lea eax, [esi + 0x4e8]
je 0x4531b94f
push eax
call edi
add esi, 0x5ec
cmp byte [esi], bl
je 0x4531b95e
push esi
call edi
mov byte [esi], bl
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4531e097
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4536277e
call fcn.4534228c
sub esp, 0x80c
push ebx
push esi
push edi
push 0x110
mov dword [ebp - 0x14], 0x80004005
call fcn.45342660
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x4531e0d7
push dword [ebp + 0x10]
call fcn.45322bf1
mov dword [ebp + 0x10], eax
jmp 0x4531e0da
mov dword [ebp + 0x10], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x14], ebx
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
je 0x4531e0f0
call fcn.45322c35
jmp 0x4531e0f5
call fcn.45322db6
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x4531e15e
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ebp - 0x10]
push ebx
push ecx
mov esi, 0x800
lea ecx, [ebp - 0x818]
push esi
push ecx
push eax
call edi
test eax, eax
je 0x4531e15e
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x818]
push eax
call fcn.453231ff
cmp eax, dword [ebp - 0x10]
jne 0x4531e15e
cmp dword [ebp - 0x10], esi
jne 0x4531e168
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x818]
push esi
push eax
push dword [ebp + 0xc]
jmp 0x4531e12a
mov ecx, dword [ebp + 0x10]
call fcn.453232a5
jmp 0x4531e16b
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0x10], ebx
je 0x4531e181
mov ecx, dword [ebp + 0x10]
call fcn.45322c07
push dword [ebp + 0x10]
call fcn.45341eb0
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10
Function at 0x45322614
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, ecx
mov eax, 0x404
mov ecx, dword [edi + 0x30]
cmp ecx, eax
ja 0x45322646
je 0x4532263f
cmp ecx, 0x401
jne 0x45322670
mov esi, 0x45375a18
jmp 0x45322698
mov esi, 0x453729c8
jmp 0x45322698
sub ecx, 0x40d
je 0x45322693
sub ecx, 4
je 0x4532268c
dec ecx
je 0x45322685
sub ecx, 0xc
je 0x4532267e
sub ecx, 0x3e6
je 0x45322677
mov eax, 0x400
sub ecx, eax
je 0x45322677
sub ecx, eax
je 0x45322677
mov esi, 0x4536e170
jmp 0x45322698
mov esi, 0x453741d0
jmp 0x45322698
mov esi, 0x45378a28
jmp 0x45322698
mov esi, 0x453711c0
jmp 0x45322698
mov esi, 0x4536f9b8
jmp 0x45322698
mov esi, 0x45377220
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
add edi, 0x5ec
xor ebx, ebx
push edi
push ebx
lea eax, [ebp - 0x110]
push str.hhCM
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x45322812
mov eax, dword [esi]
push edi
push eax
mov dword [ebp - 8], eax
add esi, 4
call fcn.45322816
lea eax, [ebp - 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push 2
push 0x453639c4
push edi
call ebx
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
jle 0x45322780
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
lea eax, [ebp - 0xc]
push 0
push eax
push 2
push 0x453639c4
push edi
call ebx
test eax, eax
je 0x4532280b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x45322715
mov eax, dword [esi]
push edi
push eax
mov dword [ebp - 8], eax
add esi, 4
call fcn.45322816
lea eax, [ebp - 0xc]
push 0
push eax
push 2
push 0x453639c4
push edi
call ebx
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
jle 0x453227ec
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
mov eax, dword [esi]
push edi
push eax
add esi, 4
call fcn.45322816
lea eax, [ebp - 0xc]
push 0
push eax
push 2
push 0x453639c4
push edi
call ebx
test eax, eax
je 0x4532280b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x453227a9
lea eax, [ebp - 0xc]
push 0
push eax
push 2
push 0x453639c4
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x45322806
Function at 0x45322816
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push str._d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 8]
lea edi, [ebp - 0x14]
or ecx, 0xffffffff
push 0
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x14]
push ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
leave
ret 8
Function at 0x4532a478
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4532a489
xor eax, eax
jmp 0x4532a58f
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push edi
push esi
push ebx
mov ecx, 0xff
not eax
jb 0x4532a569
mov edi, dword [ebp + 0x10]
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x4537a268]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4537a268]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4537a268]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4537a268]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4537a268]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4537a268]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4537a268]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x4537a268]
xor eax, esi
inc edx
dec edi
jne 0x4532a4a6
cmp dword [ebp + 0x10], 0
je 0x4532a58a
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4537a268]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x4532a56f
pop ebx
pop esi
not eax
pop edi
pop ebp
ret 0xc
Function at 0x4532ac50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x1e]
mov dword [ebp + 8], eax
jmp 0x4532ac65
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0x5e]
mov ecx, dword [ebx + 0x2e]
mov esi, dword [ebx + 0x66]
sub ecx, edx
sub ecx, esi
mov dword [ebp - 4], ecx
jne 0x4532ac83
test edx, edx
jne 0x4532ac83
test esi, esi
jne 0x4532ac83
mov ecx, eax
jmp 0x4532acfe
cmp ecx, 0xffffffff
jne 0x4532ac8d
push 0xfffffffffffffffe
pop ecx
jmp 0x4532acfe
mov esi, dword [ebx + 0x1e]
lea esi, [eax + esi - 0x106]
cmp edx, esi
jb 0x4532acfe
mov edi, dword [ebx + 0x2a]
mov ecx, eax
mov edx, ecx
lea esi, [eax + edi]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x3e]
mov ecx, dword [ebx + 0x36]
sub dword [ebx + 0x62], eax
sub dword [ebx + 0x5e], eax
sub dword [ebx + 0x4e], eax
lea ecx, [ecx + edx*2]
dec ecx
dec ecx
movzx esi, word [ecx]
mov edi, esi
sub edi, eax
cmp esi, eax
sbb esi, esi
not esi
and esi, edi
dec edx
mov word [ecx], si
jne 0x4532acc3
mov ecx, dword [ebx + 0x32]
mov esi, eax
lea ecx, [ecx + eax*2]
dec ecx
dec ecx
movzx edx, word [ecx]
mov edi, edx
sub edi, eax
cmp edx, eax
sbb edx, edx
not edx
and edx, edi
dec esi
mov word [ecx], dx
jne 0x4532ace2
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x4532ad53
mov esi, dword [ebx + 0x2a]
mov edi, dword [ebx + 0x5e]
push ecx
lea ecx, [esi + edi]
add ecx, dword [ebx + 0x66]
push ecx
push eax
call fcn.4532ad5a
add dword [ebx + 0x66], eax
mov edx, dword [ebx + 0x66]
cmp edx, 3
jb 0x4532ad3f
movzx eax, byte [esi + edi]
mov ecx, dword [ebx + 0x4a]
add esi, edi
mov dword [ebx + 0x3a], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x46]
mov dword [ebx + 0x3a], eax
cmp edx, 0x106
jae 0x4532ad53
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4532ac62
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x45338835
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
cmp eax, edx
jae 0x45338846
lea edx, [eax + 1]
mov al, byte [eax]
mov dword [ecx], edx
ret
mov eax, dword [ecx + 0x1c]
add eax, dword [ecx + 0x24]
cmp edx, eax
jae 0x4533885a
mov dword [ecx + 8], 1
or al, 0xff
ret
jmp sym.HHA.dll_Ordinal_227
Function at 0x4533eb7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx*4 + 0x453811b8]
push edi
push 1
xor ecx, ecx
cmp dword [esi + 0xc], ecx
mov edi, dword [esi + 0x1d]
pop eax
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], eax
je 0x4533eba8
mov dl, byte [esi + 0x1c]
mov byte [ebx], dl
cmp dword [ebp + 0x10], ecx
jne 0x4533ebcc
push 0xc
push 0x10
push esi
call fcn.4533ea4e
push 0xc
push 0x10
push esi
call fcn.4533ea4e
cmp dword [esi + 0xc], 0
je 0x4533ec21
inc dword [esi + 0x18]
jmp 0x4533ec21
cmp dword [esi + 0x14], eax
jne 0x4533ebde
push 0xc
push 0x10
push esi
mov dword [esi + 0x14], ecx
call fcn.4533ea4e
push dword [esi + 4]
push dword [ebp + 0x10]
push edi
call fcn.4533e9b4
test eax, eax
jle 0x4533ec09
mov ebx, eax
movzx eax, word [edi]
push dword [ebp - 4]
inc edi
inc edi
push eax
push esi
call fcn.4533eac1
xor dword [ebp - 4], 1
dec ebx
jne 0x4533ebf0
mov ebx, dword [ebp + 0xc]
push 0xc
push 0x10
push esi
call fcn.4533ea4e
cmp dword [esi + 0xc], 0
je 0x4533ec21
mov eax, dword [esi + 0x18]
mov al, byte [eax]
mov byte [esi + 0x1c], al
mov eax, dword [esi + 0x18]
pop edi
sub eax, ebx
pop esi
pop ebx
leave
ret 0xc

Function at 0x4533ec2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax*4 + 0x453811b8]
push 1
pop ebx
push dword [esi + 4]
mov edi, dword [esi + 0x1d]
push dword [ebp + 0x10]
push edi
call fcn.4533e9b4
mov ecx, dword [ebp + 0xc]
and dword [esi + 0xc], 0
test eax, eax
mov dword [esi + 0x18], ecx
jle 0x4533ec75
mov dword [ebp + 8], eax
movzx eax, word [edi]
push ebx
inc edi
push eax
push esi
inc edi
call fcn.4533eac1
xor ebx, 1
dec dword [ebp + 8]
jne 0x4533ec60
cmp dword [esi + 0xc], 0
je 0x4533ec7e
inc dword [esi + 0x18]
mov eax, dword [esi + 0x18]
pop edi
sub eax, dword [ebp + 0xc]
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4533fcb2
Capabilities:
Delete file

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4533fcca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 4], ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4533fcda
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4533fcea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 8], ebx
mov edi, dword [esi + 0x43c]
lea ebp, [esi + 0x43c]
cmp edi, ebx
je 0x4533fd09
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [ebp], ebx
mov edi, dword [esi]
cmp edi, ebx
je 0x4533fd1d
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [esi], ebx
mov eax, dword [esi + 0x434]
lea edi, [esi + 0x434]
cmp eax, ebx
je 0x4533fd35
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
mov eax, dword [esi + 0x438]
lea edi, [esi + 0x438]
cmp eax, ebx
je 0x4533fd4d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edi, [esi + 0x118]
cmp edi, ebx
je 0x4533fd6d
cmp byte [edi], bl
je 0x4533fd6d
push edi
call ebp
mov byte [edi], bl
mov word [esi + 0x21c], bx
mov edi, dword [esi + 0x424]
cmp edi, ebx
je 0x4533fd8b
mov ecx, edi
call fcn.4532297a
push edi
call fcn.45341eb0
pop ecx
mov dword [esi + 0x424], ebx
add esi, 0x10
cmp esi, ebx
je 0x4533fd9b
cmp byte [esi], bl
je 0x4533fd9b
push esi
call ebp
mov byte [esi], bl
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x453429a0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.45342a60
cmp dword [0x4537cb10], 1
mov esi, dword [esp + 0x10]
jne 0x453429c3
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4537cb0c], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x4537cb08], bl
jne 0x45342a1d
cmp dword [0x45382568], 0
je 0x45342a0b
mov edi, dword [0x45382564]
sub edi, 4
cmp edi, dword [0x45382568]
jb 0x45342a0b
mov eax, dword [edi]
test eax, eax
je 0x45342a00
call eax
sub edi, 4
cmp edi, dword [0x45382568]
jae 0x453429f8
push 0x4536e030
push 0x4536e024
call fcn.45342a80
add esp, 8
push 0x4536e038
push 0x4536e034
call fcn.45342a80
add esp, 8
test ebx, ebx
je 0x45342a3c
call fcn.45342a70
pop edi
pop esi
pop ebx
ret
mov dword [0x4537cb10], 1
Function at 0x45344f10
Capabilities:
Terminate process

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x45344e0f
nop
nop
nop
nop
nop
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45344e0f
call 0x45344e0a
xor ecx, ecx
push ecx
call 0x45344e12
add dword [esp], 0xd
call eax
xor esi, esi
jmp 0x45342a46
add byte [eax], al
add byte [ebx - 0xf2dbfc], al
sal byte [ecx], 1
imul cl
daa
fdiv st(7), st(0)
push dword [eax + 0x6f]
ja 0x45344e88
jb 0x45344e98
push 0x206c6c65
sub eax, 0x63657865
and byte [edx + 0x79], ah
jo 0x45344e95
jae 0x45344ea9
and byte [0x20706f6e], ch
sub eax, 0x206e6977
dec eax
imul esp, dword [esp + 0x65], 0x2822206e
imul esi, dword [edi + 0x72], 0x73552d20
inc edx
popal
jae 0x45344ebf
arpl word [eax], sp
push 0x73707474
cmp ch, byte [edi]
das
jb 0x45344ec3
ja 0x45344e92
imul esi, dword [si + 0x68], 0x73756275
jb 0x45344ed2
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x45344ed8
outsb dx, byte [esi]
je 0x45344ea4
arpl word [edi + 0x6d], bp
das
insd dword es:[edi], dx
outsd dx, dword [esi]
jb 0x45344eee
push 0x78657369
jns 0x45344eb4
imul esp, dword [ecx + 0x66], 0x66
das
das
insd dword es:[edi], dx
popal
imul ebp, dword [esi + 0x2f], 0x2e687568
jo 0x45344f09
push 0x3173702e
jae 0x45344ec8
xor dword [ecx], ebp
sub dword [esi], ebp
arpl word [edi + 0x6e], bp
arpl word cs:[edi + 0x6e], bp
je 0x45344f03
outsb dx, byte [esi]
je 0x45344ec1
jl 0x45344ec3
jo 0x45344f14
outsd dx, dword [esi]
ja 0x45344f0c
jb 0x45344f1c
push 0x226c6c65
add byte [ecx], al
add byte [eax], al
xor eax, eax
ret 0xc
inc ebp
test eax, eax
jle 0x45344eef
sar byte [esi + 0x2b], 0x48
sub ecx, dword [eax - 0x7d]
cmp eax, 0x4537cb0c
add byte [ebx + 0x4537ce94], ah
dec eax
cmp dword [0x4537cb0c], 0
mov dword [0x4537ce94], eax
retf
jne 0x45344ed8
add eax, 0xffdab8e8
invalid
call fcn.45342990
call fcn.45348410
call fcn.45346630
call fcn.45345090
mov eax, 1
ret 0xc
add byte [ebx], dh
rol dl, 0xc
add byte [ebx + 0xa7503f8], al
push 0
call fcn.453466f0
add esp, 4
xor eax, eax
ret 0xc
mov eax, 1
ret 0xc
or al, 0
int3
int3
push ebx
mov eax, 1
add byte [eax], al
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
push ebp
jne 0x45344f33
cmp dword [0x4537ce94], 0
jne 0x45344f33
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
cmp ebx, 1
je 0x45344f3d
cmp ebx, 2
jne 0x45344f77
mov ecx, dword [0x45381554]
test ecx, ecx
je 0x45344f56
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
call ecx
jmp 0x45344f5e
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x45344f6e
push edi
push ebx
push esi
call fcn.45344db0
test eax, eax
jne 0x45344f7f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
push edi
push ebx
push esi
call 0x45344f87
add dword [esp], 0x10
push dword [esp]
add dword [esp], 8
jmp 0x45344deb
Function at 0x45346680
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x4537d7a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x453466e3
push 0x74
push 1
call fcn.45344cb0
add esp, 8
mov edi, eax
test edi, edi
je 0x453466d9
push edi
mov eax, dword [0x4537d7a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x453466d9
push edi
call fcn.45346660
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
jmp 0x453466e3
push 0x10
call fcn.45344fd0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret