joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cad0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
push 0x90
mov dword [esp + 0x10], 0
call fcn.0047a780
mov esi, eax
add esp, 4
test esi, esi
jne 0x41cb03
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
add esp, 0x10
ret
push 0x90
push 0
push esi
call fcn.0047d730
mov ebp, dword [esp + 0x2c]
mov edi, ebp
shl edi, 4
add edi, ebp
push edi
call fcn.0047a780
add esp, 0x10
mov dword [esi + 0x7f], eax
test eax, eax
je 0x41caf1
push edi
push 0
push eax
call fcn.0047d730
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
add esp, 0xc
mov dword [esi + 4], eax
xor eax, eax
push eax
push eax
mov dword [esi], ebp
xor ebp, ebp
push eax
push ebp
xor ecx, ecx
push ebx
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x57], ebx
mov word [esi + 0x10], cx
mov dword [esi + 0x5f], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push ebp
lea eax, [esp + 0x14]
push eax
push 0x12
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41cb7f
mov ebp, dword [esp + 0x10]
jmp 0x41cb8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x41cbdb
mov edx, dword [esi + 0x7f]
xor eax, eax
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
push ebx
mov dword [esp + 0x2c], 0
mov dword [esi + 0x12], ebp
mov dword [esi + 0x16], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cbc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x41cbdb
mov eax, dword [esp + 0x18]
mov ecx, 0
add edi, 0x12
adc eax, ecx
mov dword [esi + 0x1a], edi
mov dword [esi + 0x1e], eax
mov dword [esi + 0x22], ecx
mov dword [esi + 0x26], ecx
lea eax, [esi + 0x3f]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [esp + 0xc]
test edi, edi
je 0x41cbff
push esi
call fcn.0047a868
add esp, 4
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x41ed90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4a8248
push 0x47eeb0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4aab30]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, edx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
cmp byte [0x4b1d09], al
jne 0x41edf4
mov byte [0x4b1d09], 1
push 0x4b4c60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x24], eax
xor esi, esi
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x34]
push eax
xor eax, eax
push eax
push ebx
push eax
push 3
push edi
call dword [sym.imp.KERNEL32.dll_LockFileEx]
test eax, eax
jne 0x41ee45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0x21
jne 0x41ee4a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x21
je 0x41ee12
test esi, esi
jne 0x41ee9b
push 0x4b4c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x20]
push ecx
push ebx
mov edx, dword [ebp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4b4c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x34]
push eax
xor eax, eax
push eax
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [ebp - 4], 0xfffffffe
call fcn.0041eebe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4214d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x4214fd
push esi
push edi
jmp 0x4214e0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x4940e8]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x4214e0
pop edi
pop esi
ret

Function at 0x421ac0
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x421af1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x421af1
mov dword [edi + 0x10], eax
pop edi
mov eax, 0x70a
pop esi
ret
mov edx, dword [esp + 0xc]
push 1
push 0
push 0
push edx
call fcn.0047d6f0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
ret

Function at 0x421f30
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call fcn.00421640
mov ebx, dword [esp + 0x20]
test eax, eax
je 0x421f57
call fcn.004216a0
mov edi, eax
jmp 0x421f73
call fcn.004216a0
mov esi, eax
cmp esi, ebp
je 0x421f77
push esi
call fcn.004217d0
push esi
mov edi, eax
call fcn.0047a868
add esp, 8
cmp edi, ebp
jne 0x421f84
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 8
ret
call fcn.00421640
test eax, eax
je 0x421fd4
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esp, [esp]
push edi
call ebx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x421fbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp eax, 5
jne 0x422014
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jge 0x422014
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x421fa0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
call ebx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x421ffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp eax, 5
jne 0x422014
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jge 0x422014
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x421fe0
push edi
call fcn.0047a868
add esp, 4
cmp esi, 0xffffffff
jne 0x422033
cmp dword [esp + 0x14], 2
jne 0x422033
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 0xa0a
pop ebx
add esp, 8
ret
Function at 0x4270c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x4270d7
xor ebx, ebx
jmp 0x4270ef
cmp byte [ebp], 0
je 0x4270e6
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x4270e0
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x4271ae
jmp 0x427114
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x42711c
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x42713c
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edx, dword [edx + eax]
call fcn.00420900
test eax, eax
jne 0x42719b
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
shl esi, 4
mov ecx, dword [esi + edx + 0xc]
add ecx, 4
cmp dword [ecx + 0xc], 0
je 0x427185
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x42717f
lea ecx, [ecx]
movzx esi, byte [edx]
movzx esi, byte [esi + 0x4940e8]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x427160
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x427187
xor edx, edx
push ebp
call fcn.00421560
add esp, 4
test eax, eax
je 0x4271b8
mov edi, dword [eax + 8]
test edi, edi
jne 0x4271ae
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x427110
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x42719b

Function at 0x4271c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x4271d6
xor ebx, ebx
jmp 0x4271ef
cmp byte [edi], 0
je 0x4271e6
jmp 0x4271e0
inc eax
cmp byte [eax], 0
jne 0x4271e0
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 4]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x4272ac
mov ecx, dword [ecx + 8]
push esi
mov dword [esp + 0x14], ecx
jmp 0x427214
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x42721c
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x42723c
mov edx, dword [eax]
call fcn.00420900
test eax, eax
jne 0x42728b
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x14]
je 0x427275
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x42726f
nop
movzx edi, byte [edx]
movzx edi, byte [edi + 0x4940e8]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x427250
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x427277
xor edx, edx
push edi
call fcn.00421560
add esp, 4
test eax, eax
je 0x4272a8
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x42729e
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x427210
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x42728b
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x42b530
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x42b54b
mov esi, 0x80
cmp esi, dword [edi]
jne 0x42b556
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [0x4af23c]
test eax, eax
je 0x42b561
call eax
lea ecx, [esi*8]
push ebp
push ecx
call fcn.0042ac30
mov ebp, eax
mov eax, dword [0x4af240]
add esp, 4
mov dword [esp + 8], ebp
test eax, eax
je 0x42b583
call eax
test ebp, ebp
jne 0x42b58f
pop ebp
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [edi + 0xc]
push ebx
push edx
call fcn.00420580
push ebp
mov dword [edi + 0xc], ebp
call dword [0x4aa024]
mov ebx, eax
shr ebx, 3
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x2c], ebx
mov dword [edi], ebx
call fcn.0047d730
mov ecx, dword [edi + 8]
add esp, 0x14
mov dword [edi + 8], 0
test ecx, ecx
je 0x42b66f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x42b603
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x4940e8]
lea ebp, [eax*8]
xor ebx, ebp
dec edx
xor eax, ebx
inc esi
test edx, edx
jg 0x42b5e0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x42b64a
mov esi, dword [eax]
test esi, esi
je 0x42b620
mov edx, dword [eax + 4]
jmp 0x42b622
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x42b64a
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x42b642
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x42b663
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x42b663
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x42b659
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x42b5d3
pop ebx
pop ebp
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x433590
Capabilities:
Get common file path

Disassembly:
sub esp, 0x318
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x314], eax
mov eax, dword [0x4af330]
push ebx
push ebp
mov ebp, dword [esp + 0x324]
push esi
push edi
mov edi, ecx
test eax, eax
je 0x4335d7
push eax
push 0x49d810
lea eax, [esp + 0x1c]
push eax
push 0xe6
call fcn.00433400
add esp, 0x10
jmp 0x43367e
call fcn.00421640
test eax, eax
je 0x433623
lea ecx, [esp + 0x11c]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x11c]
call fcn.00421700
mov esi, eax
test esi, esi
jne 0x433660
mov eax, 7
mov ecx, dword [esp + 0x324]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047a722
add esp, 0x318
ret
lea eax, [esp + 0x11c]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x11c]
push ecx
call fcn.00421760
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x433605
call fcn.00421700
push ebx
mov esi, eax
call fcn.0047a868
add esp, 4
test esi, esi
je 0x433605
push esi
push 0x49d810
lea edx, [esp + 0x1c]
push edx
push 0xe6
call fcn.00433400
push esi
call fcn.0047a868
add esp, 0x14
mov dl, byte [esp + 0x14]
lea eax, [esp + 0x14]
test dl, dl
je 0x433696
lea ebx, [ebx]
inc eax
cmp byte [eax], 0
jne 0x433690
lea ecx, [esp + 0x14]
sub eax, ecx
and eax, 0x3fffffff
mov ecx, eax
mov eax, str.etilqs_
inc eax
cmp byte [eax], 0
jne 0x4336a8
sub eax, str.etilqs_
and eax, 0x3fffffff
lea eax, [eax + ecx + 0x11]
cmp eax, edi
jl 0x4336ca
mov eax, 1
jmp 0x43360a
lea eax, [esp + 0x14]
test dl, dl
je 0x4336d8
inc eax
cmp byte [eax], 0
jne 0x4336d2
lea ecx, [esp + 0x14]
sub eax, ecx
and eax, 0x3fffffff
jbe 0x4336f1
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x4336f1
sub eax, 1
jne 0x4336e6
lea edx, [esp + 0x14]
push edx
push str._setilqs_
push ebp
add edi, 0xffffffef
push edi
mov byte [esp + eax + 0x24], 0
call fcn.00433400
add esp, 0x10
mov eax, ebp
test ebp, ebp
je 0x43372d
cmp byte [ebp], 0
je 0x433726
lea esp, [esp]
inc eax
cmp byte [eax], 0
jne 0x433720
sub eax, ebp
and eax, 0x3fffffff
cmp dword [0x4aa004], 0
mov esi, eax
mov edi, 0xf
lea ebx, [eax + ebp]
jne 0x43374a
mov dword [esp + 0x10], 0
jmp 0x433767
push 5
call dword [0x4aa040]
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x433767
push eax
call dword [0x4aa048]
add esp, 4
dec edi
call fcn.0042b330
mov byte [ebx], al
inc ebx
test edi, edi
jne 0x433767
mov eax, dword [esp + 0x10]
test eax, eax
je 0x433786
push eax
call dword [0x4aa050]
add esp, 4
mov ecx, 0xf
jmp 0x433790
movzx eax, byte [esi + ebp]
xor edx, edx
mov edi, 0x3e
div edi
inc esi
sub ecx, 1
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi + ebp - 1], dl
jne 0x433790
mov byte [esi + ebp], cl
xor eax, eax
jmp 0x43360a
Function at 0x4339d0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x114
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
lea ecx, [esp + 8]
push ecx
push 0x104
push eax
push edx
mov dword [esp + 0x14], 0x200
call fcn.004338b0
add esp, 0x10
test eax, eax
jne 0x433aff
push ebx
push esi
push edi
call fcn.00421640
lea ebx, [esp + 0x14]
test eax, eax
je 0x433a28
call fcn.004216a0
mov esi, eax
jmp 0x433a48
call fcn.004216a0
mov edi, eax
test edi, edi
je 0x433ac6
push edi
call fcn.004217d0
push edi
mov esi, eax
call fcn.0047a868
add esp, 8
test esi, esi
je 0x433ac6
call fcn.00421640
test eax, eax
mov eax, esi
je 0x433a8d
cmp word [esi], 0
je 0x433a76
lea ecx, [ecx]
cmp word [eax], 0x5c
je 0x433a71
add eax, 2
cmp word [eax], 0
jne 0x433a60
jmp 0x433a76
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 0xc]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x433ab7
cmp byte [esi], 0
je 0x433aa2
cmp byte [eax], 0x5c
je 0x433a9f
inc eax
cmp byte [eax], 0
jne 0x433a92
jmp 0x433aa2
mov byte [eax], 0
lea eax, [esp + 0xc]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x18]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.0047a868
add esp, 4
test edi, edi
jne 0x433ae3
pop edi
pop esi
mov eax, 0x200
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0047a722
add esp, 0x114
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0047a722
add esp, 0x114
ret
mov ecx, dword [esp + 0x110]
mov eax, dword [esp + 4]
xor ecx, esp
call fcn.0047a722
add esp, 0x114
ret
Function at 0x435340
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x43534d
xor eax, eax
pop ebx
ret
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, 0x50
call fcn.0042b020
mov edi, eax
test edi, edi
jne 0x435367
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx]
push ebp
mov ebp, dword [esp + 0x1c]
push ebp
push eax
push esi
call fcn.0042f170
mov dword [edi], eax
mov ecx, dword [ebx + 8]
push ebp
push ecx
push esi
call fcn.004350f0
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ebp
push eax
push esi
call fcn.0043d420
mov dword [edi + 0xc], eax
mov edx, dword [ebx + 0x10]
push ebp
push edx
push esi
call fcn.0042f170
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ebp
push eax
push esi
call fcn.0043d420
add esp, 0x44
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push ebp
push eax
push esi
call fcn.0042f170
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
mov byte [edi + 4], cl
mov edx, dword [ebx + 0x1c]
push ebp
push edx
push esi
call fcn.00435340
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ebp
push eax
push esi
call fcn.0043d420
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push ebp
push eax
push esi
call fcn.0043d420
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
add esp, 0x38
mov edx, 0xfff7
mov dword [edi + 0x24], eax
and cx, dx
or eax, 0xffffffff
pop ebp
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x43ebd0
mov al, byte [ebp + 0x494964]
mov byte [esp + 0x10], al
test edi, edi
je 0x43ec55
cmp byte [edi], 0
mov eax, edi
je 0x43ebeb
inc eax
cmp byte [eax], 0
jne 0x43ebe5
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x190
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x43ec3d
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x43ec33
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x4940e8]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x43ec10
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x43ec3f
xor edx, edx
push edi
call fcn.00421560
add esp, 4
test eax, eax
je 0x43ec51
mov eax, dword [eax + 8]
jmp 0x43ec5c
xor eax, eax
jmp 0x43ec5c
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x43ec6c
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x43ec8d
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x43ebd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x442400
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
push 0x4b3ac0
mov dword [0x4b3ac0], eax
mov dword [0x4b3ac4], eax
mov dword [0x4b3ac8], eax
mov dword [0x4b3acc], eax
mov dword [0x4b3ad0], eax
mov dword [0x4b3ad4], eax
mov dword [0x4b3ad8], eax
mov dword [0x4b3adc], eax
mov dword [0x4b3ae0], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.0044fd70
test eax, eax
jne 0x43b42b
push esi
cmp dword [0x4aa004], eax
jne 0x43b3e0
xor esi, esi
jmp 0x43b3fb
push 2
call dword [0x4aa040]
mov esi, eax
add esp, 4
test esi, esi
je 0x43b3fb
push esi
call dword [0x4aa048]
add esp, 4
mov edx, 0x4aa240
call fcn.00420240
mov eax, dword [0x4af238]
mov dword [0x4aa24c], eax
mov dword [0x4af238], 0x4aa240
test esi, esi
je 0x43b427
push esi
call dword [0x4aa050]
add esp, 4
xor eax, eax
pop esi
ret
xor eax, eax
ret
call fcn.0044fd70
test eax, eax
jne 0x442417
push 0xa
call fcn.0042ac30
add esp, 4
test eax, eax
jne 0x44241d
mov eax, 7
ret
push eax
call fcn.00420580
add esp, 4
jmp 0x43b390
Function at 0x44baa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esi + 0x3c]
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [edx], ebx
jne 0x44bad1
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f3f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
add esp, 0x14
test eax, eax
jne 0x44bbb2
mov ebx, eax
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x44bb0d
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.0047d6f0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 5
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], ecx
push ebp
push edi
nop
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x44bbae
mov edi, dword [ebp + 0xc]
cmp edi, dword [esi + 0x18]
ja 0x44bb9f
test byte [ebp + 0x14], 0x20
jne 0x44bb9f
mov ebx, dword [esi + 0x80]
mov eax, ebx
cdq
push edx
push eax
lea ecx, [edi - 1]
push 0
push ecx
call fcn.0047d6f0
mov ecx, dword [esi + 0x3c]
mov ebp, dword [ebp]
push edx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push edx
push ebx
push ebp
push ecx
call eax
add esp, 0x14
mov dword [esp + 0xc], eax
cmp edi, 1
jne 0x44bb81
mov ecx, dword [ebp + 0x18]
lea eax, [ebp + 0x18]
mov dword [esi + 0x64], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x68], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x6c], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x70], edx
cmp edi, dword [esi + 0x20]
jbe 0x44bb89
mov dword [esi + 0x20], edi
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [esi + 0x58]
call fcn.00442f10
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x20], ecx
test ebx, ebx
je 0x44bb10
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret