joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e123
Capabilities:
Enumerate processes

Disassembly:
push 0x28c
mov eax, 0x4ad577
call fcn.0047d2fc
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
push 0x22c
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x284]
push eax
call fcn.00459150
add esp, 0xc
lea ecx, [ebp - 0x58]
push edi
call fcn.004078d0
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004078d0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
call fcn.0044056e
lea eax, [ebp - 0x40]
push eax
call fcn.0044056e
pop ecx
pop ecx
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x43e2e0
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43e27d
mov esi, dword [ebp + 8]
cmp dword [ebp - 0x27c], esi
je 0x43e262
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
jne 0x43e1fa
mov eax, ebx
jmp 0x43e207
lea eax, [ebp - 0x260]
push eax
call fcn.0046a4eb
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407a30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.0044056e
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a370
test eax, eax
jne 0x43e253
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x298]
push eax
call fcn.0043eaa8
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00407970
lea eax, [ebp - 0x284]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43e1d1
mov esi, dword [ebp - 0x294]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x290]
jmp 0x43e2d6
push dword [esi]
lea eax, [ebp - 0x28]
push eax
call fcn.0043c872
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
call fcn.0044056e
add esp, 0xc
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x28]
cmovae eax, dword [ebp - 0x40]
push dword [ebp - 0x30]
push ebx
push eax
call fcn.00409e40
lea ecx, [ebp - 0x28]
cmp eax, 0xffffffff
jg 0x43e30b
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.00407970
add esi, 4
cmp esi, edi
jne 0x43e28c
mov ebx, dword [ebp - 0x288]
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00407970
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00407970
lea ecx, [ebp - 0x294]
call fcn.0043e698
mov eax, ebx
call fcn.0047d2b7
ret
xor ebx, ebx
inc ebx
push 0
push ebx
call fcn.00407970
jmp 0x43e2e0
Function at 0x43e318
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x4ad1ad
call fcn.0047d2fc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x26c]
xor ebx, ebx
push 0x22c
push ebx
push eax
mov edi, ebx
call fcn.00459150
add esp, 0xc
lea ecx, [ebp - 0x40]
push esi
call fcn.004078d0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.0044056e
pop ecx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x43e36d
jmp 0x43e40e
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x43e3f9
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x43e3a3
mov eax, ebx
jmp 0x43e3b0
lea eax, [ebp - 0x248]
push eax
call fcn.0046a4eb
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407a30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0044056e
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a370
lea ecx, [ebp - 0x28]
push ebx
push 1
test eax, eax
je 0x43e3ff
mov byte [ebp - 4], bl
call fcn.00407970
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43e386
jmp 0x43e407
xor edi, edi
inc edi
call fcn.00407970
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00407970
mov eax, edi
call fcn.0047d2b7
ret

Function at 0x43eafd
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x4ad5e2
call fcn.0047d2fc
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push ebx
push eax
mov dword [ebp - 0x24c], ebx
call fcn.00459150
add esp, 0xc
lea eax, [ebp - 0x218]
mov edi, ebx
push 0x104
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x43ec27
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43ec19
and dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x43eb99
lea eax, [ebp - 0x218]
push eax
call fcn.0046a4eb
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00407a30
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00440737
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00407970
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x250]
call fcn.0043e421
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.0043c065
push 0x104
lea eax, [ebp - 0x218]
inc edi
push eax
push edi
push esi
call ebx
test eax, eax
je 0x43eb4f
call fcn.0047d2b7
ret
Function at 0x43ec38
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x83c
mov eax, 0x4ad615
call fcn.0047d2fc
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
and dword [ebp - 0x848], 0
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x1c]
push eax
call fcn.004078d0
xor ecx, ecx
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 4], ecx
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
call esi
test eax, eax
je 0x43ecc9
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.00409c50
push 0
jmp 0x43ee06
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x43ecf6
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43ecb4
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x43ed29
push dword [ebp - 0x838]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
jmp 0x43ecb4
lea eax, [ebp - 0x830]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x43ed7b
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.00409c50
jmp 0x43ee05
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00459150
add esp, 0xc
mov dword [ebp - 0x840], 0x400
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x844]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x838]
call esi
push dword [ebp - 0x82c]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.0046a4eb
pop ecx
mov ecx, edi
test eax, eax
je 0x43ed6a
lea eax, [ebp - 0x810]
push eax
call fcn.004078d0
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00407970
mov eax, edi
call fcn.0047d2b7
ret
Function at 0x43ee1b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x838
mov eax, 0x4acea9
call fcn.0047d2fc
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x844], esi
call fcn.004078d0
lea eax, [ebp - 0x834]
mov dword [ebp - 0x834], esi
push eax
push 0x20119
push esi
push str.SoftWare
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x82c], esi
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x43eea6
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.00409c50
push 0
jmp 0x43ef95
lea eax, [ebp - 0x830]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x43eecf
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43ee91
lea eax, [ebp - 0x82c]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x838]
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x43ef16
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.00409c50
jmp 0x43ef94
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00459150
add esp, 0xc
mov dword [ebp - 0x83c], 0x400
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x840]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x82c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
push dword [ebp - 0x834]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.0046a4eb
pop ecx
mov ecx, edi
test eax, eax
je 0x43ef08
lea eax, [ebp - 0x810]
push eax
call fcn.004078d0
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00407970
mov eax, edi
call fcn.0047d2b7
ret
Function at 0x43efaa
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x834
mov eax, 0x4ad648
call fcn.0047d2fc
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
and dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.004078d0
xor ecx, ecx
lea eax, [ebp - 0x834]
push eax
push 0xf013f
push ecx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 4], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43f02e
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.00409c50
push 0
jmp 0x43f12c
xor ecx, ecx
lea eax, [ebp - 0x830]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push esi
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call esi
test eax, eax
je 0x43f062
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f019
xor ecx, ecx
lea eax, [ebp - 0x82c]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push ebx
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x43f09d
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
jmp 0x43f019
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00459150
add esp, 0xc
mov dword [ebp - 0x838], 0x400
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x82c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
push dword [ebp - 0x834]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.0046a4eb
pop ecx
mov ecx, edi
test eax, eax
jne 0x43f11f
lea eax, [ebp - 0x828]
push eax
call fcn.00409c50
jmp 0x43f12b
lea eax, [ebp - 0x810]
push eax
call fcn.004078d0
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00407970
mov eax, edi
call fcn.0047d2b7
ret
Function at 0x43f141
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
mov ebx, 0xf013f
push ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x43f219
lea eax, [ebp - 8]
push eax
push ebx
push edi
push str.SoftWare
push dword [ebp - 4]
call esi
test eax, eax
je 0x43f19a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f219
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0xc]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
je 0x43f1be
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f20f
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x43f1dc
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f20a
push dword [ebp + 0x18]
call fcn.0046a4eb
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x18]
push 1
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f220
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov ebx, 0xf013f
mov dword [ebp - 0xc], edi
push ebx
push edi
push str.SoftWare
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f2dd
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x43f27e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f2dc
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x43f2a4
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x43f2da
push dword [ebp + 0x14]
call fcn.0046a4eb
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f2e3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov ebx, 0xf013f
mov dword [ebp - 0xc], edi
push ebx
push edi
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f3a0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x43f341
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f39f
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x43f367
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x43f39d
push dword [ebp + 0x14]
call fcn.0046a4eb
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fcf3
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4d5210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43fe37
push ebx
push edi
xor edi, edi
xor ebx, ebx
push edi
push 0x80
push 4
push edi
inc ebx
mov dword [ebp - 0x10c], edi
push ebx
push bind
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x43fd54
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10c], eax
jmp 0x43fd5a
mov eax, dword [ebp - 0x10c]
lea esi, [eax + 1]
push esi
call fcn.00434aea
and dword [ebp - 0x11c], 0
pop ecx
push 0
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x118], eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00459150
lea eax, [ebp - 0x108]
push str.c4de314e0b813f80709ddff3cb224ba3
push eax
call fcn.0046a720
lea eax, [ebp - 0x108]
push eax
call fcn.0046a510
mov edi, dword [ebp - 0x10c]
add esp, 0x18
mov dword [ebp - 0x114], eax
xor eax, eax
mov dword [ebp - 0x110], eax
test edi, edi
jle 0x43fe25
mov edx, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x108]
cmp byte [edx], cl
jne 0x43fe19
xor ecx, ecx
xor esi, esi
cmp dword [ebp - 0x114], ecx
jle 0x43fe13
mov al, byte [edx + ecx]
cmp al, byte [ebp + ecx - 0x108]
jne 0x43fe0d
mov eax, dword [ebp - 0x114]
inc esi
cmp esi, eax
je 0x43fe27
inc ecx
cmp ecx, eax
jl 0x43fdf1
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x108]
inc eax
inc edx
mov dword [ebp - 0x110], eax
cmp eax, edi
jl 0x43fde1
xor ebx, ebx
push dword [ebp - 0x118]
call fcn.00434af3
pop ecx
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00434840
mov esp, ebp
pop ebp
ret
Function at 0x4412c6
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x4ad974
call fcn.0047d2fc
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4413c6
cmp byte [ebx + 0x3d], 0
je 0x4413c6
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x441300
xor al, al
jmp 0x4413c8
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004416fc
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x44135e
sub eax, 1
je 0x441362
dec eax
sub eax, 1
je 0x4413b4
xor bl, bl
jmp 0x4413b6
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x44139a
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0046ab5c
add esp, 0x10
cmp esi, eax
jne 0x44135a
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x4413b4
test esi, esi
jne 0x441324
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0042e720
jmp 0x44131e
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0043c065
mov al, bl
jmp 0x4413c8
mov al, 1
call fcn.0047d2b7
ret

Function at 0x441dff
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x44269c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret 4
Function at 0x4429de
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
xor ecx, ecx
xor edx, edx
xor esi, esi
push edi
cmp dword [ebp + 0xc], ecx
jle 0x442abf
mov edi, dword [ebp + 8]
mov al, byte [esi + edi]
cmp al, 0x3d
jne 0x442a02
inc edx
cmp edx, 2
jg 0x442a40
cmp al, 0x7f
ja 0x442a40
movzx eax, al
mov al, byte [eax + 0x4b6278]
cmp al, 0x7f
je 0x442a40
cmp al, 0x40
jae 0x442a1b
test edx, edx
jne 0x442a40
inc ecx
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x4429f5
test ecx, ecx
je 0x442abf
mov edi, dword [ebp + 0x14]
imul eax, ecx, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x442a45
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x442a42
push 0xffffffffffffffee
pop eax
jmp 0x442ac1
mov edx, dword [ebp + 0x10]
xor eax, eax
push ebx
xor ebx, ebx
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x442ab9
mov eax, dword [ebp + 8]
push 3
pop edi
movzx eax, byte [eax]
mov cl, byte [eax + 0x4b6278]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub edi, eax
movzx eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 0x3f
or ebx, eax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 4
jne 0x442aaa
xor eax, eax
mov dword [ebp + 0xc], eax
test edi, edi
jle 0x442a95
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp edi, 1
jle 0x442aa2
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
cmp edi, 2
jle 0x442aaa
mov byte [edx], bl
inc edx
mov eax, dword [ebp + 8]
dec esi
inc eax
mov dword [ebp + 8], eax
test esi, esi
jg 0x442a5a
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
pop ebx
xor eax, eax
pop edi
pop esi
pop ebp
ret