joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x4d1028]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x24]
test eax, eax
jne 0x430d32
mov esi, ecx
push 0x68
call fcn.0046d61c
add esp, 4
mov edi, eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0xb
mov dword [ebp - 0x24], 0x6e497972
mov dword [ebp - 0x28], 0x6f6d654d
mov dword [ebp - 0x21], 0x6172666e
mov byte [ebp - 0x1d], 0
mov ecx, edi
push eax
call fcn.004432a0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x430d12
mov ecx, dword [ebp - 0x28]
lea ebx, [eax + 1]
cmp ebx, 0x1000
jb 0x430d08
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x430d6b
add eax, 0x24
mov ecx, edx
mov ebx, eax
push ebx
push ecx
call fcn.0046d651
add esp, 8
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x24], edi
test ecx, ecx
je 0x430d23
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [esi + 0x24]
call fcn.004434c0
test al, al
je 0x430d66
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x430d49
mov eax, dword [eax + 0x88]
test eax, eax
je 0x430d4b
lock inc dword [eax + 4]
jmp 0x430d4b
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
call fcn.004798ba
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
movzx eax, byte [ebp + 0xc]
mov edx, dword [ecx]
push eax
call dword [edx + 8]
mov esi, dword [ebp + 8]
test esi, esi
je 0x430da0
lock dec dword [esi]
jne 0x430da0
mov ecx, esi
call fcn.00444420
push esi
call fcn.0046d64c
add esp, 4
pop esi
pop ebp
ret
Function at 0x431900
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.0046d7d0
mov eax, dword [0x4d1028]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4d1050]
cmp eax, 0xffffffff
je 0x431a6f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x431a6f
mov esi, eax
cmp eax, 1
jne 0x43194b
push 0
push dword [0x4d1050]
jmp 0x431a67
lea edi, [ebp - 0x810]
push 0x800
push esi
push edi
call fcn.00471f40
add esp, 0xc
mov eax, dword [0x4d1050]
push edi
mov dword [ebp - 0x1414], eax
push eax
call fcn.00444fa0
add esp, 8
push esi
call fcn.0046d68c
add esp, 4
mov esi, dword [0x4d64f0]
cmp esi, 1
ja 0x4319ca
push 0x4d64f0
call fcn.0040c670
add esp, 4
test al, al
je 0x4319c4
mov ecx, 0x4d64f4
mov esi, 0x4d64f4
call fcn.00431690
push 0x4d64f0
push 0
push 0x4d64f4
push 0x4d64f0
call fcn.0040c730
add esp, 0x10
jmp 0x4319ca
mov esi, dword [0x4d64f0]
mov ecx, esi
call fcn.00431790
lea eax, [ebp - 0x1410]
push 0xc00
push 0x4d58f0
push eax
call fcn.00471f40
add esp, 0xc
mov ecx, esi
call fcn.00431860
mov esi, 0x100
mov al, 1
jmp 0x431a08
cmp esi, 2
lea esi, [esi - 1]
jb 0x431a5f
test al, 1
je 0x431a5f
mov ebx, 0xfffff400
xor eax, eax
lea edi, [ebp - 0x810]
jmp 0x431a28
add edi, 8
add ebx, 0xc
je 0x431a00
mov ecx, dword [edi]
test ecx, ecx
je 0x431a20
cmp dword [ebp + ebx - 0x810], 0
je 0x431a20
mov edx, dword [edi + 4]
cmp edx, dword [ebp + ebx - 0x808]
jne 0x431a20
mov edx, dword [ebp + ebx - 0x80c]
test edx, edx
je 0x431a20
mov dword [edi], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x431a20
push 1
push dword [ebp - 0x1414]
call fcn.00444fa0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x431a90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x4d1050]
mov esi, ecx
cmp eax, 0xffffffff
je 0x431aad
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x431ab2
call fcn.00431b80
mov edi, dword [0x4d64f0]
cmp edi, 1
ja 0x431afe
push 0x4d64f0
call fcn.0040c670
add esp, 4
test al, al
je 0x431af8
mov ecx, 0x4d64f4
mov edi, 0x4d64f4
call fcn.00431690
push 0x4d64f0
push 0
push 0x4d64f4
push 0x4d64f0
call fcn.0040c730
add esp, 0x10
jmp 0x431afe
mov edi, dword [0x4d64f0]
mov ecx, edi
call fcn.00431790
mov eax, dword [0x4d58ec]
mov ecx, 0x100
inc eax
movzx edx, al
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x4d58f0], 0
je 0x431b26
inc eax
dec ecx
jne 0x431b10
jmp 0x431b56
mov ecx, dword [ebp + 8]
lea eax, [ebx*4 + 0x4d58f0]
mov dword [0x4d58ec], edx
mov dword [eax], 1
lea eax, [edx*4]
mov dword [eax + eax*2 + 0x4d58f4], ecx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x4d58f8]
mov dword [esi + 4], eax
mov ecx, edi
call fcn.00431860
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x431b72
cmp eax, 0x100
jge 0x431b77
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
int3
Function at 0x431b80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x4d1028]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x4d1050]
cmp eax, 0xffffffff
mov dword [ebp - 0x810], eax
jne 0x431c1e
lea esi, [ebp - 0x810]
push esi
call fcn.00444f70
add esp, 4
test al, al
je 0x431c96
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x431bf5
push esi
call fcn.00444f70
add esp, 4
test al, al
je 0x431c9b
cmp dword [ebp - 0x810], 0xffffffff
je 0x431c9b
push 0xffffffffffffffff
call fcn.00444f90
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x4d1050], ecx
mov eax, dword [ebp - 0x810]
je 0x431c1e
push eax
call fcn.00444f90
add esp, 4
mov eax, dword [0x4d1050]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x431c91
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.00472a40
add esp, 0xc
push edi
push dword [ebp - 0x810]
call fcn.00444fa0
add esp, 8
push 0x800
call fcn.0046d683
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.00471f40
add esp, 0xc
push esi
push dword [ebp - 0x810]
call fcn.00444fa0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0046d691
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x433b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x10]
cmp dword [eax + 0x14], 0xf
jbe 0x433b57
mov eax, dword [eax]
test esi, esi
mov ebx, 0x811c9dc5
mov dword [ebp - 0x10], eax
je 0x433b7f
mov edi, esi
nop word cs:[eax + eax]
nop
movzx edx, byte [eax]
inc eax
xor edx, ebx
imul ebx, edx, 0x1000193
dec edi
jne 0x433b70
mov edi, dword [ecx + 4]
and ebx, dword [ecx + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ecx + 0xc]
mov edx, dword [ecx + ebx*8]
add ebx, ebx
mov dword [ebp - 0x18], edi
cmp edx, edi
je 0x433ba6
lea eax, [ebx*4]
or eax, 4
mov eax, dword [ecx + eax]
mov edi, dword [eax]
cmp edx, edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
jne 0x433c60
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi]
mov edi, dword [ebp - 0x20]
cmp eax, edx
je 0x433bf8
mov edi, dword [ebp + 0x10]
mov esi, edx
mov edx, dword [edi + 4]
mov dword [edx], eax
mov edx, dword [eax + 4]
mov dword [edx], esi
mov edx, dword [esi + 4]
mov dword [edx], edi
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [edi + 4], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x18], eax
mov edx, dword [edi + ebx*4]
mov esi, ecx
mov ecx, dword [ebp + 0x10]
lea eax, [edi + ebx*4]
cmp edx, dword [ebp - 0x18]
je 0x433c73
cmp edx, dword [ebp - 0x1c]
je 0x433ce6
or ebx, 1
mov eax, dword [edi + ebx*4]
mov eax, dword [eax]
mov dword [edi + ebx*4], eax
mov edi, ecx
cmp eax, ecx
mov ecx, esi
je 0x433cee
mov edx, dword [ecx + 0xc]
lea eax, [edx + ebx*4]
mov edx, dword [edx + ebx*4]
mov edx, dword [edx + 4]
jmp 0x433cec
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0x10]
push esi
push eax
push ecx
call fcn.00470f8d
add esp, 0xc
mov edx, dword [ebp - 0x1c]
test eax, eax
je 0x433c88
cmp edx, edi
je 0x433bb4
mov edi, dword [edi + 4]
cmp esi, dword [edi + 0x18]
jne 0x433c58
cmp dword [edi + 0x1c], 0xf
ja 0x433c40
lea eax, [edi + 8]
jmp 0x433c43
shl ebx, 2
mov dword [eax], ecx
mov edi, ecx
mov ecx, esi
or ebx, 4
mov edx, edi
add ebx, dword [esi + 0xc]
mov eax, ebx
jmp 0x433cec
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [ecx], eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
dec dword [eax + 8]
mov eax, dword [edx + 0x1c]
cmp eax, 0x10
jb 0x433cd7
mov ecx, dword [edx + 8]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x433cca
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x433d07
add eax, 0x24
mov ecx, edx
mov esi, eax
push esi
push ecx
call fcn.0046d651
add esp, 8
mov edx, dword [ebp + 0x10]
push 0x20
push edx
call fcn.0046d651
add esp, 8
xor ecx, ecx
jmp 0x433cf5
mov edi, ecx
mov edx, ecx
mov ecx, esi
mov dword [eax], edx
call fcn.00433a40
mov cl, 1
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], cl
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.004798ba
int3
Function at 0x435d80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x10]
cmp dword [ebx + 0x14], 0xf
jbe 0x435d97
mov ebx, dword [ebx]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x435dc1
mov esi, eax
mov eax, 0x811c9dc5
mov edx, ebx
nop word [eax + eax]
movzx edi, byte [edx]
inc edx
xor edi, eax
imul eax, edi, 0x1000193
dec esi
jne 0x435db0
jmp 0x435dc6
mov eax, 0x811c9dc5
and eax, dword [ecx + 0x18]
mov edi, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + eax*8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
jmp 0x435e07
mov eax, dword [esi + 8]
push ecx
push ebx
push eax
call fcn.00470f8d
mov ecx, dword [ebp - 0x10]
add esp, 0xc
test eax, eax
je 0x435e36
mov esi, dword [esi]
cmp dword [ebp - 0x1c], edi
je 0x435e20
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
cmp eax, esi
jne 0x435e26
jmp 0x435ea4
mov eax, edi
cmp eax, esi
je 0x435ea4
cmp dword [esi + 0x18], ecx
jne 0x435e05
cmp dword [esi + 0x1c], 0xf
ja 0x435df0
lea eax, [esi + 8]
jmp 0x435df3
mov dword [ebp - 0x20], ebx
mov ebx, esi
cmp dword [ebp - 0x1c], edi
je 0x435e60
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
cmp eax, ebx
jne 0x435e66
jmp 0x435ea0
mov eax, edi
cmp eax, ebx
je 0x435ea0
cmp ecx, dword [ebx + 0x18]
jne 0x435ea0
cmp dword [ebx + 0x1c], 0xf
jbe 0x435e80
mov eax, dword [ebx + 8]
jmp 0x435e83
lea eax, [ebx + 8]
push ecx
push eax
push dword [ebp - 0x20]
call fcn.00470f8d
mov ecx, dword [ebp - 0x10]
add esp, 0xc
test eax, eax
jne 0x435ea0
mov ebx, dword [ebx]
cmp dword [ebp - 0x1c], edi
jne 0x435e40
jmp 0x435e60
cmp esi, ebx
jne 0x435ea8
mov esi, edi
mov ebx, edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x437710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4d1028]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ecx]
mov edi, dword [esi + 4]
cmp byte [edi + 0xd], 0
je 0x437750
mov edi, esi
cmp esi, dword [edi]
je 0x43779d
cmp byte [esi + 0xd], 0
je 0x4377b5
mov ebx, dword [esi + 8]
mov edi, dword [ebp + 0x10]
mov dl, 1
jmp 0x437817
mov dl, byte [ebp + 0xc]
mov ebx, dword [eax]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ecx
nop dword [eax + eax]
mov esi, edi
mov edi, dword [edi + 0x10]
xor ecx, ecx
cmp edi, ebx
setae cl
xor eax, eax
cmp ebx, edi
setb al
test dl, dl
cmovne eax, ecx
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov edi, dword [esi + ecx*8]
cmp byte [edi + 0xd], 0
je 0x437760
test al, al
je 0x4377cf
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp esi, dword [edi]
jne 0x43773d
lea eax, [ebp - 0x14]
push edx
push dword [ebp + 0x10]
push esi
push 1
push eax
call fcn.00437870
mov eax, dword [ebp - 0x14]
jmp 0x437836
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x4377db
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
je 0x4377ef
mov edi, dword [ebp + 0x10]
mov dl, 1
mov ebx, eax
jmp 0x437817
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp + 0x10]
xor edx, edx
mov ebx, esi
jmp 0x437817
mov edi, dword [ebp + 0x10]
nop
mov ebx, eax
mov eax, dword [eax + 8]
cmp byte [eax + 0xd], 0
je 0x4377e0
mov dl, 1
jmp 0x437817
cmp esi, dword [eax]
mov edi, dword [ebp + 0x10]
je 0x437804
mov ebx, esi
jmp 0x43780f
cmp ebx, dword [eax]
jne 0x43780f
mov ebx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x437800
cmp byte [ebx + 0xd], 0
mov dl, 1
je 0x4377c9
mov eax, dword [ebx + 0x10]
cmp eax, dword [edi]
jae 0x43783e
movzx eax, dl
lea edx, [ebp - 0x18]
push dword [ebp + 0x14]
push edi
push esi
push eax
push edx
call fcn.00437870
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov byte [ebx + 4], 1
jmp 0x437856
push 0x30
push dword [ebp + 0x14]
call fcn.0046d651
add esp, 8
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov ebx, eax
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43a47c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [0x4d1028]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp byte [esi + 0xd], 0
je 0x43a4a7
mov dword [ebp - 0x14], eax
mov edi, eax
jmp 0x43a4ee
mov edx, dword [edx]
xor ebx, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov edi, esi
mov esi, dword [esi + 0x10]
xor ecx, ecx
cmp esi, edx
setae cl
xor eax, eax
cmp edx, esi
setb al
cmp byte [ebp + 0xc], 0
cmovne eax, ecx
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov esi, dword [edi + ecx*8]
cmp byte [esi + 0xd], bl
je 0x43a4b1
mov ebx, dword [ebp + 8]
test al, al
mov dword [ebp - 0x14], edi
je 0x43a528
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x28]
cmp edi, dword [eax]
je 0x43a509
mov esi, ebx
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov ecx, ebx
call fcn.0043a6dc
mov ecx, dword [ebx]
mov al, 1
mov ebx, esi
jmp 0x43a52c
mov al, byte [ebp - 0x1c]
lea esi, [ebp - 0x18]
mov byte [esp + 0x10], al
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], 1
jmp 0x43a557
xor eax, eax
mov ecx, edi
mov edx, dword [ecx + 0x10]
mov esi, dword [ebp + 0x10]
cmp edx, dword [esi]
jae 0x43a569
mov cl, byte [ebp - 0x20]
mov edx, esi
movzx eax, al
mov byte [esp + 0x10], cl
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x18]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp], esi
call fcn.0043a586
sub esp, 0x14
mov eax, dword [esi]
mov dword [ebx], eax
mov byte [ebx + 4], 1
jmp 0x43a56f
mov dword [ebx], ecx
mov byte [ebx + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43dcf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4d1028]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ecx]
mov edi, dword [esi + 4]
cmp byte [edi + 0xd], 0
je 0x43dd30
mov edi, esi
cmp esi, dword [edi]
je 0x43dd7d
cmp byte [esi + 0xd], 0
je 0x43dd95
mov ebx, dword [esi + 8]
mov edi, dword [ebp + 0x10]
mov dl, 1
jmp 0x43ddf7
mov dl, byte [ebp + 0xc]
mov ebx, dword [eax]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ecx
nop dword [eax + eax]
mov esi, edi
mov edi, dword [edi + 0x10]
xor ecx, ecx
cmp edi, ebx
setge cl
xor eax, eax
cmp ebx, edi
setl al
test dl, dl
cmovne eax, ecx
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov edi, dword [esi + ecx*8]
cmp byte [edi + 0xd], 0
je 0x43dd40
test al, al
je 0x43ddaf
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp esi, dword [edi]
jne 0x43dd1d
lea eax, [ebp - 0x14]
push edx
push dword [ebp + 0x10]
push esi
push 1
push eax
call fcn.0042ca00
mov eax, dword [ebp - 0x14]
jmp 0x43de16
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x43ddbb
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
je 0x43ddcf
mov edi, dword [ebp + 0x10]
mov dl, 1
mov ebx, eax
jmp 0x43ddf7
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp + 0x10]
xor edx, edx
mov ebx, esi
jmp 0x43ddf7
mov edi, dword [ebp + 0x10]
nop
mov ebx, eax
mov eax, dword [eax + 8]
cmp byte [eax + 0xd], 0
je 0x43ddc0
mov dl, 1
jmp 0x43ddf7
cmp esi, dword [eax]
mov edi, dword [ebp + 0x10]
je 0x43dde4
mov ebx, esi
jmp 0x43ddef
cmp ebx, dword [eax]
jne 0x43ddef
mov ebx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x43dde0
cmp byte [ebx + 0xd], 0
mov dl, 1
je 0x43dda9
mov eax, dword [ebx + 0x10]
cmp eax, dword [edi]
jge 0x43de1e
movzx eax, dl
lea edx, [ebp - 0x18]
push dword [ebp + 0x14]
push edi
push esi
push eax
push edx
call fcn.0042ca00
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov byte [ebx + 4], 1
jmp 0x43de36
push 0x18
push dword [ebp + 0x14]
call fcn.0046d651
add esp, 8
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov ebx, eax
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x4d1028]
xor eax, ebp
mov dword [esp + 0x20], eax
mov edi, dword [ecx + 0x40]
test edi, edi
jne 0x43e969
mov esi, ecx
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 9
mov dword [esp + 8], 0x63736964
mov dword [esp + 0xc], 0x65647261
mov word [esp + 0x10], 0x64
push 0x48
call fcn.0046d61c
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.0043e750
mov ecx, ebx
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x10]
push eax
call fcn.0043f7a0
mov edi, dword [esi + 0x40]
mov dword [esi + 0x40], ebx
test edi, edi
je 0x43e930
mov ecx, edi
call fcn.0043f890
push edi
call fcn.0046d64c
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
jb 0x43e966
mov ecx, dword [esp + 8]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x43e95c
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43e97e
add eax, 0x24
mov ecx, edx
mov edi, eax
push edi
push ecx
call fcn.0046d651
add esp, 8
mov edi, dword [esi + 0x40]
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.0046d691
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004798ba
int3
Function at 0x44556c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x4d1028]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x2c], 0
je 0x44567b
mov esi, ecx
lea edx, [ecx + 0x24]
lea eax, [ebp - 0x58]
lea edi, [ebp - 0x5c]
mov ecx, edi
push eax
push 2
call fcn.0044569b
add esp, 8
mov edx, dword [edi]
test edx, edx
je 0x445682
cmp dword [edx], 0
mov dword [ebp - 0x68], esi
je 0x44566e
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x60], edx
add eax, 0x18
mov dword [ebp - 0x6c], eax
xor eax, eax
test dword [edx + eax*8 + 8], 0xc0000020
mov dword [ebp - 0x64], eax
jne 0x445662
cmp dword [ebp + 8], 0
je 0x445622
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [eax + 4], ecx
je 0x445622
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x64]
add ecx, ebx
mov esi, dword [edx + eax*8 + 4]
call fcn.00445ff0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edx, dword [ebp - 0x60]
test eax, eax
jne 0x445662
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x44
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xf0f0f0f1
cmp edi, eax
jb 0x4455ea
mov eax, dword [ebp - 0x64]
lea edi, [ebp - 0x54]
mov ecx, edi
push dword [edx + eax*8 + 4]
call fcn.00445d34
mov esi, dword [ebp - 0x68]
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
cmp edx, eax
je 0x445655
mov ebx, 0x44
push ebx
push edi
push eax
call fcn.00471f40
add esp, 0xc
add dword [esi + 0x1c], ebx
jmp 0x44565f
mov ecx, dword [ebp - 0x6c]
push edi
push edx
call fcn.00438f3c
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
inc eax
cmp eax, dword [edx]
jb 0x4455c5
push edx
call fcn.0046d68c
add esp, 4
xor esi, esi
jmp 0x445685
mov esi, 0x3f0
jmp 0x445685
mov esi, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x44887c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x4d6acc]
cmp eax, 1
ja 0x44893a
push 0x4d6acc
call fcn.0040c670
add esp, 4
test al, al
je 0x448935
xor edi, edi
mov dword [0x4d6ad4], edi
mov dword [0x4d6ad0], edi
mov dword [0x4d6adc], edi
mov dword [0x4d6ad8], edi
mov dword [0x4d6ae0], edi
push str.userenv
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.CreateAppContainerProfile
push eax
call ebx
mov dword [0x4d6ad0], eax
push str.DeriveAppContainerSidFromAppContainerName
push esi
call ebx
mov dword [0x4d6ad4], eax
push str.DeleteAppContainerProfile
push esi
call ebx
mov dword [0x4d6ad8], eax
push str.GetAppContainerRegistryLocation
push esi
call ebx
mov dword [0x4d6adc], eax
push str.GetAppContainerFolderPath
push esi
call ebx
mov dword [0x4d6ae0], eax
mov eax, 0x4d6acc
push eax
push edi
push 0x4d6ad0
push eax
call fcn.0040c730
add esp, 0x10
mov eax, 0x4d6ad0
jmp 0x44893a
mov eax, dword [0x4d6acc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44976c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
call fcn.00449510
test al, al
je 0x449790
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
mov ecx, edi
push 0
call fcn.004497de
lea ecx, [esi + 0x30]
call fcn.00438ece
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4497b4
push eax
call fcn.0041ba90
add esp, 4
mov ecx, edi
call fcn.00449802
lea ecx, [esi + 0x18]
call fcn.00439130
lea ecx, [esi + 0x14]
call fcn.00439130
lea ecx, [esi + 0x10]
call fcn.00439130
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.00449420