joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c6f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push 0x10
push ebx
call fcn.0041c170
mov dword [ebp - 0x10], 0
mov ecx, eax
mov dword [ebp - 8], ecx
mov edx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], 0
test ebx, ebx
je 0x41c903
push esi
mov esi, 0x3f
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edx
mov dl, byte [edi]
test dl, dl
je 0x41c8fe
mov bl, byte [edi + 1]
test bl, bl
je 0x41c8fe
mov ah, byte [edi + 2]
mov byte [ebp - 1], ah
test ah, ah
je 0x41c8fe
mov bh, byte [edi + 3]
add edi, 4
test bh, bh
je 0x41c8fe
mov al, dl
sub al, 0x41
cmp al, 0x19
ja 0x41c776
movsx ecx, dl
sub ecx, 0x41
jmp 0x41c7aa
mov al, dl
sub al, 0x61
cmp al, 0x19
ja 0x41c786
movsx ecx, dl
sub ecx, 0x47
jmp 0x41c7aa
mov al, dl
sub al, 0x30
cmp al, 9
ja 0x41c796
movsx ecx, dl
add ecx, 4
jmp 0x41c7aa
cmp dl, 0x2b
jne 0x41c7a2
mov ecx, 0x3e
jmp 0x41c7aa
xor ecx, ecx
cmp dl, 0x2f
cmove ecx, esi
mov al, bl
sub al, 0x41
cmp al, 0x19
ja 0x41c7ba
movsx esi, bl
sub esi, 0x41
jmp 0x41c7f3
mov al, bl
sub al, 0x61
cmp al, 0x19
ja 0x41c7ca
movsx esi, bl
sub esi, 0x47
jmp 0x41c7f3
mov al, bl
sub al, 0x30
cmp al, 9
ja 0x41c7da
movsx esi, bl
add esi, 4
jmp 0x41c7f3
cmp bl, 0x2b
jne 0x41c7e6
mov esi, 0x3e
jmp 0x41c7f3
xor esi, esi
mov edx, 0x3f
cmp bl, 0x2f
cmove esi, edx
mov al, ah
sub al, 0x41
cmp al, 0x19
ja 0x41c803
movsx edx, ah
sub edx, 0x41
jmp 0x41c83c
mov al, ah
sub al, 0x61
cmp al, 0x19
ja 0x41c813
movsx edx, ah
sub edx, 0x47
jmp 0x41c83c
mov al, ah
sub al, 0x30
cmp al, 9
ja 0x41c823
movsx edx, ah
add edx, 4
jmp 0x41c83c
cmp ah, 0x2b
jne 0x41c82f
mov edx, 0x3e
jmp 0x41c83c
xor edx, edx
cmp ah, 0x2f
mov eax, 0x3f
cmove edx, eax
mov al, bh
sub al, 0x41
cmp al, 0x19
ja 0x41c84c
movsx eax, bh
sub eax, 0x41
jmp 0x41c881
mov al, bh
sub al, 0x61
cmp al, 0x19
ja 0x41c85c
movsx eax, bh
sub eax, 0x47
jmp 0x41c881
mov al, bh
sub al, 0x30
cmp al, 9
ja 0x41c86c
movsx eax, bh
add eax, 4
jmp 0x41c881
cmp bh, 0x2b
jne 0x41c878
mov eax, 0x3e
jmp 0x41c881
xor eax, eax
cmp bh, 0x2f
cmove eax, dword [ebp - 0x18]
shl ecx, 6
or ecx, esi
shl ecx, 6
or ecx, edx
shl ecx, 6
or ecx, eax
cmp byte [ebp - 1], 0x3d
jne 0x41c8a8
cmp bh, 0x3d
jne 0x41c8a8
mov edx, dword [ebp - 0xc]
mov eax, 1
shr ecx, 0x10
jmp 0x41c8cf
mov esi, dword [ebp - 0x1c]
mov eax, ecx
mov edx, dword [ebp - 0xc]
shr eax, 0x10
inc edx
mov byte [esi], al
mov eax, ecx
shr eax, 8
mov byte [edx], al
cmp bh, 0x3d
jne 0x41c8c9
mov eax, 2
jmp 0x41c8d1
inc edx
mov eax, 3
mov byte [edx], cl
mov ebx, dword [ebp - 0x10]
mov esi, 0x3f
add ebx, eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
adc eax, 0
inc edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], edx
test eax, eax
jb 0x41c732
ja 0x41c8fe
cmp ebx, dword [ebp + 0x10]
jb 0x41c732
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41df50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor eax, eax
mov dword [ebp - 0x14], str.application
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x18], eax
mov edi, 0x405
lea eax, [ebp - 0x1c]
mov word [ebp - 0xe], di
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x1c], 0xb
push eax
call fcn.00417b70
mov ecx, dword [esi]
mov eax, dword [ebp - 4]
shl ecx, 5
add ecx, dword [esi + 8]
cmp eax, ecx
je 0x41df9e
add eax, 0x10
jmp 0x41dfb9
xor eax, eax
mov dword [0x5d1310], eax
mov dword [0x5d1314], eax
mov dword [0x5d1318], eax
mov dword [0x5d131c], eax
mov eax, 0x5d1310
mov ebx, 0x1000
test word [eax + 0xe], bx
jne 0x41dfc7
mov eax, dword [eax + 8]
push 0x10
push 0
push eax
call fcn.00503211
mov dword [ebp - 0xc], eax
add esp, 0xc
xor eax, eax
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x10], eax
mov ecx, esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
mov word [ebp - 0xe], di
push eax
mov dword [ebp - 0x14], 0x5313c0
mov dword [ebp - 0x1c], 3
call fcn.00417b70
mov ecx, dword [esi]
mov eax, dword [ebp - 4]
shl ecx, 5
add ecx, dword [esi + 8]
cmp eax, ecx
je 0x41e017
add eax, 0x10
jmp 0x41e032
xor eax, eax
mov dword [0x5d1310], eax
mov dword [0x5d1314], eax
mov dword [0x5d1318], eax
mov dword [0x5d131c], eax
mov eax, 0x5d1310
mov eax, dword [eax]
mov ecx, esi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
mov word [ebp - 0xe], di
push eax
mov dword [ebp - 0x14], str.hash
mov dword [ebp - 0x1c], 4
call fcn.00417b70
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
shl ecx, 5
add ecx, dword [esi + 8]
cmp eax, ecx
je 0x41e074
add eax, 0x10
jmp 0x41e08f
xor eax, eax
mov dword [0x5d1310], eax
mov dword [0x5d1314], eax
mov dword [0x5d1318], eax
mov dword [0x5d131c], eax
mov eax, 0x5d1310
test word [eax + 0xe], bx
jne 0x41e098
mov eax, dword [eax + 8]
push 0x10
push 0
push eax
call fcn.00503211
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov ebx, dword [ebp + 8]
mov esi, eax
mov edi, edx
xor eax, eax
xor eax, 0xaf63bd4c
push edi
push esi
push dword [ebp - 4]
push dword [ebp + 0xc]
push ecx
push pe_nt_image_headers32
push 0x1b3
xor ecx, 0x8601b7df
push eax
push ecx
call fcn.004fa430
xor eax, dword [ebp + 0xc]
xor edx, 0
push pe_nt_image_headers32
push 0x1b3
push edx
push eax
call fcn.004fa430
xor eax, dword [ebp - 4]
xor edx, 0
push pe_nt_image_headers32
push 0x1b3
push edx
push eax
call fcn.004fa430
push pe_nt_image_headers32
push 0x1b3
xor edx, 0
xor eax, esi
push edx
push eax
call fcn.004fa430
xor edx, 0
xor eax, edi
push edx
push eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42de20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
push pe_nt_image_headers32
push 0x1b3
push dword [ebx + 4]
push dword [ebx]
call fcn.004fa430
mov edi, dword [ebp + 8]
mov esi, eax
mov ecx, edx
xor esi, 0xff
xor ecx, 0
mov dword [ebx], esi
mov dword [ebx + 4], ecx
mov al, byte [edi]
inc edi
mov byte [ebp + 0xb], al
test al, al
je 0x42de90
jmp 0x42de60
push pe_nt_image_headers32
push 0x1b3
push ecx
push esi
call fcn.004fa430
mov esi, eax
lea edi, [edi + 1]
movzx eax, byte [ebp + 0xb]
mov ecx, edx
cdq
xor esi, eax
xor ecx, edx
mov dword [ebx], esi
mov dword [ebx + 4], ecx
mov al, byte [edi - 1]
mov byte [ebp + 0xb], al
test al, al
jne 0x42de60
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x431ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp - 4], esi
mov eax, dword [edi + 0xc]
cmp eax, 1
jne 0x431bd1
mov eax, dword [ebp + 0xc]
push ebx
cmp dword [edi + 0x14], eax
jne 0x431b36
cmp dword [edi + 8], eax
jne 0x431b36
cmp byte [ebp + 0x14], 0
lea ebx, [esi + 0x178]
je 0x431b13
push ebx
call fcn.004f7e77
add esp, 4
test eax, eax
jne 0x431bf7
mov eax, dword [ebx + 0x2c]
cmp eax, 0x7fffffff
je 0x431bfe
push 0
push dword [edi]
push dword [esi + 0xc]
call fcn.00505ddb
add esp, 0xc
test eax, eax
jns 0x431b41
mov eax, dword [ebp + 0x14]
test al, al
je 0x431b36
push ebx
call fcn.004f7e88
add esp, 4
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 4]
mov esi, dword [edi + 8]
push dword [eax + 0xc]
push esi
push 1
push dword [ebp + 8]
call fcn.00505a4a
add esp, 0x10
cmp eax, esi
jne 0x431b26
cmp byte [ebp + 0x14], 0
je 0x431b6b
push ebx
call fcn.004f7e88
add esp, 4
cmp dword [edi + 0x10], 0
je 0x431bc6
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call fcn.0043c870
add esp, 0xc
cmp eax, dword [edi + 0x10]
je 0x431bc6
call fcn.0041ca10
cmp eax, 2
jg 0x431b36
push str.CRC_mismatch__n
push 2
call fcn.0041d050
add esp, 8
test al, al
jne 0x431b36
push str.Fossilize_ERROR:_CRC_mismatch__n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
add esp, 8
xor al, al
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 2
jne 0x431bed
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00431c10
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 5
call fcn.004f80b2
dec eax
push 6
mov dword [ebx + 0x2c], eax
call fcn.004f80b2
int3
Function at 0x431c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51f235
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
cmp dword [edi + 0x14], eax
je 0x431c4e
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
mov al, byte [ebp + 0x14]
lea ecx, [ebx + 0x178]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x1c], al
test al, al
je 0x431c92
push ecx
call fcn.004f7e77
add esp, 4
test eax, eax
jne 0x431e1c
mov eax, dword [ebx + 0x1a4]
cmp eax, 0x7fffffff
je 0x431e23
mov al, byte [ebp + 0x14]
mov byte [ebp - 4], 1
test al, al
je 0x431d5f
push dword [edi + 8]
call fcn.004fa284
mov esi, eax
mov dword [ebp + 0x10], eax
add esp, 4
mov dword [ebp - 0x14], esi
push 0
push dword [edi]
push dword [ebx + 0xc]
call fcn.00505ddb
add esp, 0xc
test eax, eax
js 0x431dbe
push dword [ebx + 0xc]
push dword [edi + 8]
push 1
push dword [ebp + 0x10]
call fcn.00505a4a
add esp, 0x10
cmp eax, dword [edi + 8]
jne 0x431dbe
cmp byte [ebp + 0x14], 0
mov byte [ebp - 4], 0
je 0x431cfd
lea eax, [ebx + 0x178]
push eax
call fcn.004f7e88
add esp, 4
cmp dword [edi + 0x10], 0
je 0x431df4
push dword [edi + 8]
push dword [ebp + 0x10]
push 0
call fcn.0043c870
add esp, 0xc
cmp eax, dword [edi + 0x10]
je 0x431df4
call fcn.0041ca10
cmp eax, 2
jg 0x431dd0
push str.CRC_mismatch__n
push 2
call fcn.0041d050
add esp, 8
test al, al
jne 0x431dd0
push str.Fossilize_ERROR:_CRC_mismatch__n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
add esp, 8
jmp 0x431dd0
mov ecx, dword [edi + 8]
mov eax, dword [ebx + 0x16c]
mov dword [ebp + 0x10], eax
cmp dword [ebx + 0x170], ecx
jae 0x431cb1
push ecx
push eax
call fcn.005069c5
add esp, 8
mov dword [ebp + 0x10], eax
test eax, eax
je 0x431d9c
mov dword [ebx + 0x16c], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x170], eax
jmp 0x431cb1
push dword [ebx + 0x16c]
call fcn.0050562e
mov dword [ebx + 0x16c], 0
add esp, 4
mov dword [ebx + 0x170], 0
cmp byte [ebp + 0x14], 0
je 0x431dd0
mov eax, dword [ebp - 0x18]
push eax
call fcn.004f7e88
add esp, 4
xor bl, bl
test esi, esi
je 0x431ddf
push esi
call fcn.004fa28d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push dword [edi + 8]
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 0x10]
mov dword [ebp - 0x10], ebx
push eax
push dword [ebp + 8]
call fcn.0043cbf0
add esp, 0x10
test eax, eax
jne 0x431dd0
cmp dword [ebp - 0x10], ebx
jne 0x431dd0
mov bl, 1
jmp 0x431dd2
push 5
call fcn.004f80b2
dec eax
push 6
mov dword [ebx + 0x1a4], eax
call fcn.004f80b2
int3
Function at 0x431e40
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
cmp dword [eax + 0x154], 1
jne 0x431eeb
mov eax, dword [edi]
call dword [eax + 0x28]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x431eeb
push dword [ebp + 8]
push ebx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0x431eeb
push ebx
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x431ee4
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 4]
push ebx
mov eax, dword [eax + 0x2c]
call eax
test al, al
jne 0x431ef6
call fcn.0041ca10
cmp eax, 2
jg 0x431edd
push str.Failed_to_write_metadata_block._n
push 2
call fcn.0041d050
add esp, 8
test al, al
jne 0x431edd
push str.Fossilize_ERROR:_Failed_to_write_metadata_block._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x432780
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 4]
cmp dword [eax], 0
jne 0x43280b
cmp dword [eax + 4], 0
jne 0x43280b
push 0
push 0
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x432840
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4327d5
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x10]
mov ecx, dword [ebx + 4]
push esi
call fcn.00432d50
mov bl, al
test bl, bl
je 0x4327fa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0041ca10
cmp eax, 2
jg 0x432840
push str.Cannot_use_imported_metadata_along_with_white__or_blacklists._n
push 2
call fcn.0041d050
add esp, 8
test al, al
jne 0x432840
push str.Fossilize_ERROR:_Cannot_use_imported_metadata_along_with_white__or_blacklists._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4344a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, ecx
cmp byte [edi + 0x174], 0
je 0x434600
cmp dword [edi + 0x168], 1
jne 0x434600
mov edx, dword [edi + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
test edx, edx
je 0x4344fd
lea ebx, [ebp - 0x20]
push ebx
push ecx
push eax
push dword [ebp + 8]
push edx
call fcn.00431f10
add esp, 0x14
test al, al
je 0x434600
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x18]
jmp 0x434560
mov eax, dword [ebp + 8]
shl eax, 5
add eax, edi
mov dword [ebp + 8], eax
lea ebx, [eax + 0x28]
lea eax, [ebp + 0xc]
mov ecx, ebx
push eax
call fcn.00404420
push eax
lea eax, [ebp + 0xc]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404900
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x434530
mov ecx, dword [ebx + 4]
mov eax, dword [ebp + 8]
cmp ecx, dword [eax + 0x2c]
je 0x434600
mov eax, dword [ecx + 0x10]
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], eax
test esi, esi
je 0x434600
mov ecx, dword [ebp + 0x1c]
mov edx, ecx
and edx, 1
je 0x434575
lea eax, [ebx + 0x10]
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x434627
cmp dword [esi], eax
jb 0x434600
shr ecx, 1
and ecx, 0xffffff01
mov dword [esi], eax
push ecx
test edx, edx
je 0x43460b
lea eax, [edi + 0x178]
push eax
lea ecx, [ebp + 0xc]
call fcn.00430670
mov eax, dword [ebp - 0x20]
push 0
add eax, 0xfffffff0
push eax
push dword [edi + 0xc]
call fcn.00505ddb
add esp, 0xc
test eax, eax
js 0x4345ef
push dword [edi + 0xc]
mov esi, dword [ebp - 0x18]
add esi, 0x10
push esi
push 1
push ebx
call fcn.00505a4a
add esp, 0x10
cmp eax, esi
jne 0x4345ef
cmp byte [ebp + 0x10], 0
je 0x434629
push dword [ebp + 0xc]
call fcn.004f7e88
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp byte [ebp + 0x10], 0
je 0x434600
push dword [ebp + 0xc]
call fcn.004f7e88
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x20]
push ecx
push eax
push ebx
mov ecx, edi
call fcn.00431ac0
test al, al
je 0x434600
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov dword [esi], eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x434730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f35d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
lea ebx, [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebx + 0x10]
lea esi, [ebp - 0x20]
mov dword [ebp - 0x20], 0x63756224
lea edx, [esi + 1]
mov dword [ebp - 0x1c], 0x6474656b
mov word [ebp - 0x18], 0x7269
mov byte [ebp - 0x16], 0
mov al, byte [esi]
inc esi
test al, al
jne 0x434774
mov eax, 0xa
sub esi, edx
cmp ecx, eax
cmovb eax, ecx
cmp dword [ebx + 0x14], 0xf
mov dword [ebp - 0x10], eax
mov ecx, ebx
jbe 0x434794
mov ecx, dword [ebx]
push edi
cmp esi, eax
lea edx, [ebp - 0x20]
mov edi, eax
cmovb edi, esi
sub edi, 4
jb 0x4347b5
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4347ba
add ecx, 4
add edx, 4
sub edi, 4
jae 0x4347a4
cmp edi, 0xfffffffc
je 0x4347ee
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4347e7
cmp edi, 0xfffffffd
je 0x4347ee
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4347e7
cmp edi, 0xfffffffe
je 0x4347ee
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4347e7
cmp edi, 0xffffffff
je 0x4347ee
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4347ee
sbb eax, eax
or eax, 1
jmp 0x4347f0
xor eax, eax
pop edi
test eax, eax
jne 0x4348d7
cmp dword [ebp - 0x10], esi
jb 0x4348d7
ja 0x4348d7
mov esi, dword [ebp - 0x14]
cmp dword [esi + 0x20], 0xa
jbe 0x4348d7
cmp dword [ebx + 0x14], 0xf
jbe 0x43481d
mov ebx, dword [ebx]
cmp byte [ebx + 0xa], 0x2f
je 0x434838
cmp dword [esi + 0x24], 0xf
lea eax, [esi + 0x10]
jbe 0x43482e
mov eax, dword [eax]
cmp byte [eax + 0xa], 0x5c
jne 0x4348d7
xor eax, eax
lea ecx, [esi + 0x10]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x10]
cmp eax, 0xb
jb 0x4348e9
add eax, 0xfffffff5
or edx, 0xffffffff
cmp eax, 0xffffffff
cmovb edx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x43486f
mov ecx, dword [ecx]
lea eax, [ecx + 0xb]
push edx
push eax
lea ecx, [ebp - 0x38]
call fcn.004011f0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
call fcn.0043b8f0
add esp, 0xc
lea ecx, [esi + 0x10]
push eax
call fcn.00430d90
lea ecx, [ebp - 0x50]
call fcn.00401760
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x4348d7
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4348cd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4348ee
push ecx
push edx
call fcn.004fa253
add esp, 8
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.00431440
call fcn.004ff45f
int3
Function at 0x4378e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
pop ebp
jmp fcn.004378f0
Function at 0x437b70
Capabilities:
Create process on windows
Read file via mapping
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
pop ebp
jmp fcn.00437b80

Function at 0x439700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f67f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004f88a5
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x43978b
push eax
push esi
call fcn.004f8bb0
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004f7e51
int3

Function at 0x43b6a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x43b6b4
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x43b6fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43b6f7
cmp dword [esi + 0x14], 0xf
jbe 0x43b6d6
mov esi, dword [esi]
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.0050a9b0
add esp, 8
test eax, eax
js 0x43b6f7
mov eax, dword [ebp - 0x32]
shr eax, 0xe
test al, 1
pop esi
setne al
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43bfc0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp dword [eax + 0x14], 0xf
jbe 0x43bfd1
mov eax, dword [eax]
push esi
push 0xffffffffffffffff
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43bff9
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret