joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d36
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408d75
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408d75
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408d75
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408d75
cmp dword [ecx + 0x74], 0xe
jbe 0x408d75
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42f4c2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42f501
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42f501
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42f501
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42f501
cmp dword [ecx + 0x74], 0xe
jbe 0x42f501
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43a372
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d9ac
push 0x45d9a4
push str.FlsAlloc
push 0x1f
call fcn.0043a040
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43a3a6
push dword [ebp + 8]
mov ecx, esi
call dword [0x45a1e8]
call esi
jmp 0x43a3ac
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x43a3f0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d9bc
push 0x45d9b4
push str.FlsGetValue
push 0x21
call fcn.0043a040
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43a427
push dword [ebp + 8]
mov ecx, esi
call dword [0x45a1e8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x43a42f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d9c4
push 0x45d9bc
push str.FlsSetValue
push 0x22
call fcn.0043a040
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43a469
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x45a1e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43beff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x469c58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43bf3f
cmp byte [ebx], 0xa
jne 0x43bf3f
or byte [edi + eax + 0x28], 4
jmp 0x43bf44
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x43c043
mov dl, byte [eax]
cmp dl, 0x1a
je 0x43c026
inc eax
cmp dl, 0xd
je 0x43bf70
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x43bf96
cmp eax, ecx
jae 0x43bfa4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x43bf58
jmp 0x43c043
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43c021
cmp dword [ebp - 0x10], 0
je 0x43c021
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x469c58]
test byte [eax + edi + 0x28], 0x48
je 0x43bffb
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x43bfe6
mov byte [esi], dl
jmp 0x43bff7
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x469c58]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x43c043
cmp byte [ebp - 1], 0xa
jne 0x43c00a
cmp esi, ebx
jne 0x43c00a
mov byte [esi], 0xa
jmp 0x43c042
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044eec8
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x43c043
mov byte [esi], 0xd
jmp 0x43c042
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x469c58]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x43c040
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x43c043
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43c04c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x469c58]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43c092
cmp word [ebx], dx
jne 0x43c092
or byte [eax + edi + 0x28], 4
jmp 0x43c097
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x43c1fa
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x43c1da
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x43c0d8
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x43c10e
cmp eax, edx
jae 0x43c11c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x43c0b3
jmp 0x43c1fa
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43c1d5
cmp dword [ebp - 0x18], 0
je 0x43c1d5
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x469c58]
test byte [eax + edi + 0x28], 0x48
je 0x43c1ab
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x43c16f
mov word [esi], cx
jmp 0x43c1a6
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x469c58]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x469c58]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x469c58]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x43c1fa
pop eax
cmp word [ebp - 4], ax
jne 0x43c1bb
cmp esi, ebx
jne 0x43c1bb
mov word [esi], ax
jmp 0x43c1f7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0044eec8
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x43c1fa
push 0xd
pop eax
jmp 0x43c1b6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x469c58]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x43c1f4
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x43c1fa
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43f4c2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043f396
Function at 0x43fcff
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x468440]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x43fd4a
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004400d1
test al, al
jne 0x43fd44
sub edx, 2
cmp edx, edi
jne 0x43fd2a
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x43fd6c
lea eax, [edi + 2]
cmp edx, eax
je 0x43fd6c
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0043f9c6
add esp, 0x10
jmp 0x43fe66
push esi
lea ecx, [ebp - 0x255]
call fcn.004400d1
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43fdaf
push dword [ebp - 0x25c]
jmp 0x43fd5c
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x43fdec
cmp word [ebp - 0x226], 0
je 0x43fe0d
cmp word [ebp - 0x226], ax
jne 0x43fdec
cmp word [ebp - 0x224], 0
je 0x43fe0d
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0043f9c6
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x43fe59
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x43fdc6
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x43fe41
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43fe66
push 0x43f4e5
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0044f800
add esp, 0x10
jmp 0x43fe36
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040817a
leave
ret
Function at 0x441361
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4413fe
push ebx
push esi
call fcn.0044131d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044125a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4413ab
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4413fd
push edi
push eax
call fcn.00437239
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4413cb
call fcn.004371ff
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4413fc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044125a
add esp, 0x20
test eax, eax
jne 0x4413ea
push edi
call fcn.004371ff
jmp 0x4413f2
push ebx
call fcn.004371ff
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x441401
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x441412
pop esi
ret
push ebx
push edi
push esi
call fcn.0044131d
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00437239
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x44143a
push ebx
push esi
push edi
call fcn.00411c60
add esp, 0xc
push 0
call fcn.004371ff
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x441d29
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004416af

Function at 0x444c1a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00436f02
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x444c89
cmp esi, dword [ebp - 4]
je 0x444c84
cmp dword [ebp + 0xc], 0
je 0x444c84
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x444c61
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0044476c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x444c8b
xor eax, eax
inc eax
jmp 0x444c8b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x444cf0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x468440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00436f02
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00436f02
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x444d67
cmp word [ecx], dx
je 0x444d67
mov eax, dword [0x45ea34]
push edi
dec eax
push eax
push 0x45e920
call fcn.00444c8f
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x444dda
cmp word [eax], dx
je 0x444dda
mov eax, dword [edi]
test eax, eax
je 0x444d8b
cmp word [eax], dx
je 0x444d8b
lea eax, [ebp - 0x10]
push eax
call fcn.00444672
jmp 0x444d94
lea eax, [ebp - 0x10]
push eax
call fcn.0044470d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x444e04
mov eax, dword [0x45e91c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x45e610
call fcn.00444c8f
add esp, 0xc
test al, al
je 0x444e04
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x444dcf
cmp word [eax], di
je 0x444dcf
lea eax, [ebp - 0x10]
push eax
call fcn.00444672
pop ecx
jmp 0x444e06
lea eax, [ebp - 0x10]
push eax
call fcn.0044470d
jmp 0x444dcc
mov eax, dword [edi]
test eax, eax
je 0x444df1
cmp word [eax], dx
je 0x444df1
lea eax, [ebp - 0x10]
push eax
call fcn.00444609
pop ecx
jmp 0x444e04
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x444ecf
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00444b14
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x444ecf
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x444ecf
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x444ecf
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x444e5c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0043a700
test ebx, ebx
je 0x444eca
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0043a700
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x444ecf
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x444ecf
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00450cc3
add esp, 0x10
xor eax, eax
inc eax
jmp 0x444ed1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040817a
leave
ret
Function at 0x4534e9
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0045330d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x453658
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x453658
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x45360d
jg 0x453545
test eax, eax
je 0x453603
push 1
push 0x1000
call fcn.0043eff5
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x453568
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4535fa
push 0x8000
push ebx
call fcn.00431644
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x453591
jg 0x45358c
cmp ecx, 0x1000
jb 0x453591
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0043d65a
add esp, 0x10
cmp eax, 0xffffffff
je 0x4535d6
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x45358c
jl 0x4535bd
test ecx, ecx
jne 0x45357e
push dword [ebp - 0xc]
push ebx
call fcn.00431644
push esi
call fcn.004371ff
add esp, 0xc
xor ebx, ebx
jmp 0x453666
cmp byte [edi + 0x24], 0
je 0x4535ed
cmp dword [edi + 0x20], 5
jne 0x4535ed
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4535f8
mov ebx, dword [edi + 0x18]
jmp 0x4535fa
xor ebx, ebx
push esi
call fcn.004371ff
pop ecx
jmp 0x453666
test ecx, ecx
jg 0x4535cf
jl 0x45360d
test eax, eax
jae 0x4535cf
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044eec8
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x45362d
cmp byte [edi + 0x1c], 0
je 0x4535cf
jmp 0x45365e
push ebx
call fcn.0044215b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4535cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x453666
cmp byte [edi + 0x1c], 0
je 0x453663
mov ebx, dword [edi + 0x18]
jmp 0x453666
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0044eec8
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x455fa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x455fcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x455fcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x447ff7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x448006
pop dword [ebp - 0x14]
mov eax, 0x94ebb28e
add eax, 0x6b58cd78
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x692a9cb9
add dword [ebp - 0x24], 0xe527a892
mov dword [ebp - 0x20], 0x949ffdd4
sub dword [ebp - 0x20], 0x626cb18f
mov dword [ebp - 0x1c], 0x9fe2e1c5
add dword [ebp - 0x1c], 0xac696269
mov dword [ebp - 0x18], 0x15cc59f1
sub dword [ebp - 0x18], 0x15cc59f1
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x6bfc212e
add dword [ebp - 0x24], 0x8764828
mov dword [ebp - 0x20], 0x3b472b3b
sub dword [ebp - 0x20], 0xf9dac9c6
mov dword [ebp - 0x1c], 0xbeb24da4
add dword [ebp - 0x1c], 0xa4bd1ec8
mov dword [ebp - 0x18], 0xe2cd8a31
sub dword [ebp - 0x18], 0xe2cd8a31
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x4e124
push 0
call eax
mov ecx, 0x4b0c
mov ebx, eax
mov esi, 0xb0c2e56d
sub esi, 0xb07b856d
add esi, dword [ebp - 0x14]
mov edx, 0x39f3eed6
sub edx, 0x10a97394
add dword [ebp - 8], 0xc0ddf985
mov edi, dword [esi]
sub dword [ebp - 4], ebx
xor edi, edx
xor dword [ebp - 0xc], 0x470831c4
mov dword [ebx], edi
add dword [ebp - 0x10], edx
add ebx, 4
add esi, 0xbac38b73
add esi, 0x453c7491
loop 0x448118
add eax, 0x11f03
mov ebx, eax
add eax, 5
mov ecx, 0x64ccd9e0
sub ecx, 0x648cd9e0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x430a1f
pop dword [ebp - 0x24]
mov eax, 0x4d2ab916
add eax, 0xb3185109
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x398c7
push 0
mov eax, 0x665c5a0e
add eax, 0x99e72622
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x91697ed6
sub ecx, 0x91693b6e
mov edi, eax
mov esi, 0x2e82d5e5
add esi, 0xd1c1f01b
add esi, dword [ebp - 0x24]
mov ebx, 0xa7d6e4c5
add dword [ebp - 0x10], esi
mov edx, dword [esi]
sub dword [ebp - 8], 0x8011488a
add edx, ebx
xor dword [ebp - 4], 0x4a2f3006
mov dword [edi], edx
mov dword [ebp - 0x14], 0x67a7676a
add edi, 0x1eeb0003
sub edi, 0x1eeaffff
add esi, 0xf81b2f36
add esi, 0x7e4d0ce
loop 0x430a78
add eax, 0x103e72fc
add eax, 0xefc28d77
xor ebx, ebx
add ebx, eax
add eax, 0x556ea11f
add eax, 0xaa915ee6
mov ecx, 0x1f909e44
sub ecx, 0x1f509e44
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4
Function at 0x409ce0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ae5c
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5a7464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea edi, [esi + 8]
mov dword [esi], vtable.CCurlDownloader.0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x409d3d
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
lea edi, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x409d5c
mov eax, dword [edi]
jmp 0x409d5e
mov eax, edi
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x409d7f
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409d70
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.004067d0
lea ebx, [esi + 0x48]
mov byte [ebp - 4], 3
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 8
jb 0x409da7
mov eax, dword [ebx]
jmp 0x409da9
mov eax, ebx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x409dd0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409dc0
sub ecx, dword [ebp + 8]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.004067d0
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x409de5
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x409ded
mov ebx, dword [ebx]
push dword [ebp - 0x10]
push ecx
push edi
push ebx
lea ecx, [esi + 0x60]
call fcn.0041ae50
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2c]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x60]
push 1
push eax
mov dword [ebx + 0xf0], 0
mov byte [ebx + 0xf4], 0
call fcn.0041b110
cmp dword [eax + 0x14], 8
jb 0x409e29
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x409e45
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406f30
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc