joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4314e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test ecx, ecx
je 0x43150c
mov edx, dword [esp + 4]
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4bbe28]
dec ecx
inc edx
test ecx, ecx
jne 0x4314f0
pop esi
not eax
ret

Function at 0x431510
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x431536
xor eax, eax
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x431550
Capabilities:
Get disk information

Disassembly:
push 4
call fcn.00440d39
mov ecx, dword [esp + 8]
mov dl, byte [ecx]
add esp, 4
xor ecx, ecx
push eax
mov byte [eax], dl
mov word [eax + 2], cx
call dword [sym.imp.USER32.dll_CharUpperW]
mov edx, 0xffbf
add word [eax], dx
mov cl, byte [eax]
mov dword [esp + 4], 0
push eax
mov byte [esp + 8], cl
call fcn.00440d2e
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [esp + 4]
mov edx, 1
shl edx, cl
test edx, eax
setne al
ret

Function at 0x4315f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x431616
xor eax, eax
pop esi
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push edi
push ecx
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov edi, ecx
test edi, edi
je 0x431652
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push 0
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x4316b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4316c5
xor eax, eax
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x431a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4bdbb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
setne al
push 0
push 0
mov dword [ebp - 8], 1
add eax, 2
push eax
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x431af2
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004644d0
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x431b03
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 0xc]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x431b24
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 0xc]
je 0x431b2b
mov dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
jne 0x431b72
test ebx, ebx
jne 0x431b72
test edi, edi
je 0x431b4f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x431b53
xor eax, eax
jmp 0x431b69
lea esi, [eax + eax]
mov eax, esi
call fcn.004644e0
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.0040f410
push eax
call fcn.004681b2
add esp, 4
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004644d0
mov esp, ebp
pop ebp
ret
Function at 0x431c70
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov ebx, 3
mov dword [esp + 0x14], edi
cmp edi, ebx
jbe 0x431d1c
cmp word [ebp + ebx*2], 0x5c
jne 0x431d13
call fcn.00449852
push eax
push ebx
push ebp
lea ecx, [esp + 0x1c]
call fcn.00410f20
mov esi, dword [esp + 0x10]
push esi
call fcn.00431920
add esp, 4
test eax, eax
jne 0x431cf7
push ecx
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00411090
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00431bb0
add esp, 4
test eax, eax
jne 0x431d7e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x431d58
mov edi, dword [esp + 0x14]
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431d13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebx
cmp ebx, edi
jb 0x431c95
push ebp
call fcn.00431920
add esp, 4
test eax, eax
jne 0x431d9a
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebp
call fcn.00411f40
call fcn.00431bb0
add esp, 4
test eax, eax
jne 0x431d9a
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x431d9c
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431d74
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431d9a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x434b10
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x489e2b
mov eax, dword fs:[0]
push eax
sub esp, 0xa60
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0xa5c], eax
push ebx
push esi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0xa6c]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa7c]
xor eax, eax
push 0x400
push eax
lea ecx, [esp + 0x66e]
push ecx
mov word [esp + 0x670], ax
call fcn.00463850
xor edx, edx
push 0x400
push edx
lea eax, [esp + 0x276]
push eax
mov word [esp + 0x278], dx
call fcn.00463850
add esp, 0x18
push 0x200
push esi
lea ecx, [esp + 0x66c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x664]
push 0x5c
push edx
call fcn.0046450c
add esp, 8
test eax, eax
je 0x434bbd
xor ecx, ecx
mov word [eax + 2], cx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x664]
push edx
lea eax, [esp + 0x264]
push str._sRC.tmp
push eax
call esi
push 0x24c
lea ecx, [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x28], 0
call fcn.00463850
add esp, 0x18
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x434d3d
mov ecx, 0x48e754
lea eax, [esp + 0x3c]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x434c46
test dx, dx
je 0x434c42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x434c46
add eax, 4
add ecx, 4
test dx, dx
jne 0x434c20
xor eax, eax
jmp 0x434c4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x434d22
mov ecx, 0x48dc88
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x434c86
test dx, dx
je 0x434c82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x434c86
add eax, 4
add ecx, 4
test dx, dx
jne 0x434c60
xor eax, eax
jmp 0x434c8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x434d22
test byte [esp + 0x10], 0x10
jne 0x434d22
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x668]
push edx
lea eax, [esp + 0x268]
push 0x48e758
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x260]
push ecx
lea ecx, [esp + 0x10]
call fcn.00419b30
mov edx, dword [eax]
push edx
push str.CleanRCXTempFile_Delete_File:__s.
mov dword [esp + 0xa7c], 0
call fcn.00427230
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
mov dword [esp + 0xa74], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434d14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x434c14
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [esp + 0xa6c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xa5c]
xor ecx, esp
call fcn.004644d0
add esp, 0xa6c
ret
Function at 0x4394f0
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x28c8
call fcn.00465640
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x28c4], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x28d8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x14], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.Not_found
lea edx, [esp + 0x2894]
push edx
lea esi, [esp + 0x18]
call ebx
movzx eax, byte [esp + 0x1a4]
cmp eax, 0xffffffff
jne 0x4395a8
lea ecx, [eax + 7]
movzx edx, byte [esi + 0x195]
cmp edx, 0xffffffff
jne 0x4395a8
movzx edx, byte [esi + 0x196]
cmp edx, 0xffffffff
jne 0x4395a8
movzx edx, byte [esi + 0x197]
cmp edx, 0xffffffff
jne 0x4395a8
movzx edx, byte [esi + 0x198]
cmp edx, 0xffffffff
jne 0x4395a8
movzx edx, byte [esi + 0x199]
cmp edx, 0xffffffff
jne 0x4395a8
cmp dword [esi + 0x1a0], ecx
je 0x4395a8
mov esi, dword [esi]
test esi, esi
je 0x4395a8
movzx edx, byte [esi + 0x194]
cmp edx, 0xffffffff
je 0x439552
movzx ecx, byte [esp + 0x1a9]
movzx edx, byte [esp + 0x1a8]
push ecx
movzx ecx, byte [esp + 0x1ab]
push edx
movzx edx, byte [esp + 0x1ae]
push ecx
movzx ecx, byte [esp + 0x1b1]
push edx
push ecx
push eax
lea edx, [esp + 0x28a8]
push str._02x_02x_02x_02x_02x_02x
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x28b0]
push 0x20
push eax
call fcn.00466400
add esp, 0x28
lea ecx, [esp + 0x2890]
push ecx
push edi
call ebx
mov ecx, dword [esp + 0x28d0]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004644d0
add esp, 0x28c8
ret

Function at 0x439670
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x14], eax
mov ecx, dword [0x499ef0]
mov edx, dword [0x499ef4]
xor eax, eax
mov dword [0x4c4530], eax
mov dword [0x4c4534], eax
mov dword [0x4c4538], eax
mov dword [0x4c453c], eax
mov dword [0x4c4540], eax
mov dword [0x4c4544], eax
mov dword [0x4c4548], eax
mov dword [0x4c454c], eax
mov eax, dword [str.Beijing_E_SafeNet]
mov dword [0x4c4530], eax
mov eax, dword [0x499ef8]
mov dword [0x4c4534], ecx
mov cx, word [0x499efc]
mov dword [0x4c4538], edx
mov edx, dword [str.CDGCobra_DocGuard]
mov dword [0x4c453c], eax
mov eax, dword [0x499edc]
mov word [0x4c4540], cx
mov ecx, dword [0x499ee0]
mov dword [esp], edx
mov edx, dword [0x499ee4]
mov dword [esp + 4], eax
mov ax, word [0x499ee8]
push 0x4c4530
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov word [esp + 0x14], ax
call fcn.00439630
lea ecx, [esp + 4]
push ecx
call fcn.00439630
add esp, 8
xor edx, edx
lea esp, [esp]
mov al, byte [edx + 0x4c4530]
xor ecx, ecx
jmp 0x439740
xor al, byte [esp + ecx]
add ecx, 6
xor al, byte [esp + ecx - 5]
xor al, byte [esp + ecx - 4]
xor al, byte [esp + ecx - 3]
xor al, byte [esp + ecx - 2]
xor al, byte [esp + ecx - 1]
cmp ecx, 0x12
jl 0x439740
mov byte [edx + 0x4c4530], al
inc edx
cmp edx, 0x20
jl 0x439730
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004644d0
add esp, 0x18
ret
Function at 0x43a880
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x43a8d7
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push edi
lea esp, [esp]
inc cl
movzx edi, cl
mov bl, byte [eax + edi + 8]
add dl, bl
movzx edx, dl
mov cl, byte [eax + edx + 8]
mov byte [eax + edi + 8], cl
add cl, bl
movzx ecx, cl
mov byte [eax + edx + 8], bl
movzx ecx, byte [ecx + eax + 8]
xor byte [esi + ebp], cl
inc esi
cmp esi, dword [esp + 0x1c]
mov dword [esp + 0x14], edi
mov ecx, edi
jl 0x43a8a0
pop edi
pop ebp
pop ebx
mov dword [eax + 4], edx
mov dword [eax], ecx
pop esi
ret

Function at 0x43b160
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0043abf0
mov dword [esi + 0x14], eax
movzx eax, al
add eax, dword [esi + 0x18]
mov ecx, esi
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 8], al
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x1c]
push edx
push eax
call fcn.0043abf0
mov dword [esi + 0x1c], eax
pop esi
ret 4
Function at 0x43b830
Capabilities:
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x230
push 0xffffffffffffffff
push 0x48a370
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4bdbb0]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x238]
mov esi, ecx
cmp byte [esi + 0xe4], 0xff
je 0x43b884
xor eax, eax
jmp 0x43b973
xor ebx, ebx
mov dword [ebp - 0x14], 1
cmp byte [ebp + 0x23c], bl
jne 0x43b949
cmp dword [esi + 0x60], ebx
jne 0x43b8b6
call fcn.0043ab10
mov ecx, dword [esi + 0x68]
cmp ecx, dword [eax + 0x14]
je 0x43b8bd
push 0xffffffffffffff9a
mov ecx, esi
call fcn.0043b5f0
jmp 0x43b8bd
mov dword [ebp - 0x14], 0xffffffff
mov ecx, esi
call fcn.0043ab10
cmp word [eax + 0xe], 8
jne 0x43b8d4
lea edx, [esi + 0x28]
push edx
call fcn.00480060
cmp edi, ebx
je 0x43b949
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
call fcn.00466118
mov dword [ebp + 0x10], eax
mov dword [ebp], eax
add esp, 4
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov dword [ebp + 0x14], edx
mov dword [ebp + 4], edx
mov byte [ebp + 0x20], bl
call fcn.0043ab10
mov ecx, eax
call fcn.0043de20
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
lea eax, [ebp]
push eax
push edi
mov dword [ebp + 0xc], edx
call fcn.00441c52
mov ecx, esi
call fcn.0043ab10
mov ecx, dword [eax + 0x24]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x43b949
mov dword [ebp - 0x14], 0xfffffffe
lea ecx, [esi + 0xe8]
mov dword [ebp - 4], 0xffffffff
call fcn.004401d0
lea ecx, [esi + 0x6c]
mov byte [esi + 0xe4], bl
call fcn.0043f410
mov ecx, esi
call fcn.0043b280
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.004644d0
add ebp, 0x230
mov esp, ebp
pop ebp
ret 8
Function at 0x43bba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xe8]
push ebp
mov ecx, edi
call fcn.0043f870
test al, al
jne 0x43bbc3
pop edi
pop esi
xor al, al
pop ebp
ret 4
lea ecx, [esi + 0x78]
call fcn.0043e340
cmp eax, 1
je 0x43bbbb
cmp byte [esi + 0xe4], 0
jne 0x43bbbb
lea ecx, [esi + 0x20]
call fcn.00440bc0
push ebp
mov ecx, edi
call fcn.00440100
mov ecx, esi
call fcn.0043ab10
mov ecx, eax
call fcn.0043dbd0
test al, al
je 0x43bc1c
cmp dword [esi + 0x10], 0
je 0x43bbbb
mov ecx, esi
call fcn.0043b400
mov ecx, esi
call fcn.0043b440
test al, al
jne 0x43bc1c
push 0xffffffffffffff94
mov ecx, esi
call fcn.0043b5f0
mov ecx, esi
call fcn.0043ab10
movzx edi, word [eax + 0xe]
test di, di
je 0x43bc39
cmp di, 8
je 0x43bc3f
push 0xffffffffffffff9b
call fcn.0043b5f0
cmp di, 8
jne 0x43bc6c
cmp byte [esi + 4], 0
je 0x43bc4d
lea eax, [esi + 0xc8]
jmp 0x43bc4f
xor eax, eax
push 0x38
push 0x499f10
mov dword [esi + 0x50], eax
push 0xfffffffffffffff1
lea eax, [esi + 0x28]
push eax
call fcn.004800b0
push eax
mov ecx, esi
call fcn.0043b6a0
mov ecx, esi
call fcn.0043ab10
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x64], ecx
mov ecx, esi
call fcn.0043ab10
mov ecx, eax
call fcn.0043dbd0
test al, al
je 0x43bc8f
add dword [esi + 0x64], 0xfffffff4
mov ecx, esi
call fcn.0043ab10
mov edx, dword [eax + 0x1c]
pop edi
mov dword [esi + 0x60], edx
mov dword [esi + 0x68], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0xe4], 0xff
pop esi
mov al, 1
pop ebp
ret 4
Function at 0x43c1c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48a406
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push edi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov eax, dword [esp + 0x234]
mov esi, dword [esp + 0x230]
push 0
push 0
push 0
push 0
push 0x100
lea ecx, [esp + 0x30]
push ecx
push 3
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x30], 0
call fcn.00465992
add esp, 0x24
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
call fcn.00411f40
mov edi, eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x22c], 0
call fcn.00411f40
push edi
push eax
push esi
mov byte [esp + 0x234], 1
call fcn.00413630
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x228], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43c295
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x228], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c2c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004644d0
add esp, 0x220
ret

Function at 0x43c4c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48a4a6
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x408], eax
push esi
push edi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
mov eax, dword [esp + 0x42c]
mov esi, dword [esp + 0x428]
push 0x100
lea ecx, [esp + 0x18]
push ecx
push 0x100
lea edx, [esp + 0x220]
push edx
push 0
push 0
push 0
push 0
push eax
mov dword [esp + 0x30], 0
call fcn.00465992
add esp, 0x24
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00411f40
mov edi, eax
lea ecx, [esp + 0x214]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x424], 0
call fcn.00411f40
push edi
push eax
push esi
mov byte [esp + 0x42c], 1
call fcn.00413630
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x420], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43c59e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x420], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c5c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.004644d0
add esp, 0x418
ret
Function at 0x43c600
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x48a509
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.00411f40
push 0x4a2058
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.00419550
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0043c1c0
lea ecx, [esp + 0x14]
push ecx
push eax
mov byte [esp + 0x30], 1
mov dword [esp + 0x20], 1
call fcn.00411100
add esp, 0x10
or esi, 0xffffffff
test al, al
jne 0x43c697
mov edx, dword [esp + 0xc]
push edx
call fcn.0043b080
add esp, 4
cmp eax, esi
je 0x43c697
xor bl, bl
jmp 0x43c699
mov bl, 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c6c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x43c78f
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0043c1c0
mov eax, dword [eax]
push eax
mov byte [esp + 0x2c], 2
call fcn.0043c600
add esp, 0xc
test al, al
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c710
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x43c749
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x20], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x43c735
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 0xc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43c78f
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x20], esi
lea edx, [eax + 0xc]
lock xadd dword [edx], esi
dec esi
test esi, esi
jg 0x43c735
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov dword [esp + 0x20], esi
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x43c7b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret