joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42db40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ecx
push edi
mov dword [ebp - 4], ebx
mov edi, 8
mov eax, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 0xffffffff
or ecx, 0xffffffff
cmp edi, 0xffffffff
mov esi, edi
cmova esi, ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x42db81
mov byte [0], al
test bl, 1
je 0x42db94
lea ecx, [ebp - 0xc0]
and ebx, 0xfffffffe
call fcn.00419d30
mov eax, dword [ebp - 8]
sub edi, esi
add eax, esi
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov ecx, 0xffffffff
test edi, edi
jne 0x42db68
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431e50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4b2a70]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x431e73
call fcn.0042cdc0
mov esi, eax
mov eax, dword [0x4b6d58]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
jne 0x431e88
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x431ede
mov eax, dword [0x4b2a70]
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x431ea1
call fcn.0042cdc0
mov ecx, eax
mov eax, dword [0x4b6d58]
push 0x20
mov dword [ecx + eax*4], 0xffffffff
call fcn.00460c38
add esp, 4
mov ecx, eax
call fcn.00431ef0
mov ecx, dword [0x4b2a70]
mov esi, eax
push ecx
call edi
mov ecx, eax
test ecx, ecx
jne 0x431ed6
call fcn.0042cdc0
mov ecx, eax
mov eax, dword [0x4b6d58]
mov dword [ecx + eax*4], esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x431fc0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x4b6d5c]
mov dword [esp], 0
push esi
test eax, 0xfffffffe
jne 0x432043
mov ecx, 1
mov edx, 0x4b6d5c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x432018
mov eax, dword [0x4b6d5c]
cmp eax, 1
jne 0x432043
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
mov eax, dword [0x4b6d5c]
cmp eax, 1
je 0x432000
mov eax, dword [0x4b6d5c]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x4b6d60], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b6d60], eax
cmp eax, 0xffffffff
jne 0x432039
mov byte [0], 0
mov dword [0x4b6d5c], 0x4b6d60
mov eax, dword [0x4b6d5c]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4358b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x435920
push ebx
push esi
mov ebx, ecx
mov eax, dword [edi]
lea edi, [edi + 4]
movzx esi, cl
movzx edx, al
xor esi, edx
shr ecx, 8
mov dword [ebp - 4], eax
movzx eax, ah
xor ecx, dword [esi*4 + 0x496870]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 2]
xor ecx, dword [edx*4 + 0x496870]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 1]
xor ecx, dword [edx*4 + 0x496870]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x496870]
sub ebx, 1
jne 0x4358c7
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x438c6b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 6
mov edx, edi
pop ecx
call fcn.00413fb0
test al, al
je 0x438d04
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0040d5f0
push eax
mov ecx, edi
call fcn.0040d0f0
lea ecx, [ebp - 0x1c]
call fcn.0040d070
push ecx
push ecx
mov esi, esp
mov eax, str.User_Data
push eax
mov dword [esi], eax
call fcn.004011e1
pop ecx
mov dword [esi + 4], eax
mov ecx, edi
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d7f0
push eax
mov ecx, edi
call fcn.0040d0f0
lea ecx, [ebp - 0x1c]
call fcn.0040d070
xor bl, bl
cmp dword [edi + 0x14], 8
jb 0x438ce5
mov eax, dword [edi]
jmp 0x438ce7
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x438cfb
test al, 0x10
je 0x438cfb
mov bl, 1
jmp 0x438d02
mov ecx, edi
call fcn.00411ad0
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c27
mov esp, ebp
pop ebp
ret
Function at 0x4394b9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.00463e50
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x439619
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x258]
call fcn.0040197a
push ecx
lea ecx, [ebp - 0x288]
call fcn.0040fbb0
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x288]
call fcn.00411050
push str.notify_relaunch_4_update
lea ecx, [ebp - 0x240]
call fcn.004019b5
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x288]
call fcn.00410960
xor ebx, ebx
lea ecx, [ebp - 0x240]
push edi
inc ebx
push ebx
call fcn.00401abf
push ecx
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x288]
call fcn.00411160
push 0x40
lea eax, [ebp - 0x2cc]
push edi
push eax
call fcn.00463e50
add esp, 0xc
mov dword [ebp - 0x2d0], 0x44
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x2a4], ebx
push 5
pop eax
push ecx
lea ecx, [ebp - 0x2d0]
mov word [ebp - 0x2a0], ax
push ecx
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4395da
mov esi, edi
jmp 0x4395f2
push dword [ebp - 0x264]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x268]
call esi
mov esi, ebx
push edi
push ebx
lea ecx, [ebp - 0x228]
call fcn.004019ef
lea ecx, [ebp - 0x288]
call fcn.0040fe30
push edi
push ebx
lea ecx, [ebp - 0x258]
call fcn.004019ef
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c27
mov esp, ebp
pop ebp
ret
Function at 0x43a23f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x1c]
push str.Software360ChromeChrome
call fcn.0040197a
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 0x2001b
cmovae eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push eax
push 0x80000001
call fcn.00416d80
cmp dword [ebp - 0x28], 0
je 0x43a29a
push str.launch_fail
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x28]
call fcn.00416e70
lea ecx, [ebp - 0x28]
call fcn.00416e40
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004019ef
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460c27
mov esp, ebp
pop ebp
ret

Function at 0x43a3b7
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x1c]
push str.Software360ChromeChrome
call fcn.0040197a
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 0x2001b
cmovae eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push eax
push 0x80000001
call fcn.00416d80
cmp dword [ebp - 0x28], 0
je 0x43a412
push str.ceup
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x28]
call fcn.00416e70
lea ecx, [ebp - 0x28]
call fcn.00416e40
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004019ef
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460c27
mov esp, ebp
pop ebp
ret

Function at 0x43a434
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x4ae6e0
call fcn.004618a0
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x43a49b
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x43a49b
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x43a49b
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x43a49b
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x43a4a4
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.004618e6
ret
Function at 0x43a520
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x4b6d84]
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x4b6d7c]
test edx, edx
jne 0x43a56e
test eax, eax
je 0x43a581
mov edx, eax
mov dword [0x4b6d84], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x43a581
cmp ecx, ebx
jb 0x43a581
cmp ecx, edi
jbe 0x43a65c
mov edx, eax
test eax, eax
jmp 0x43a5a3
test edx, edx
je 0x43a59e
mov eax, dword [edx + 8]
test eax, eax
je 0x43a59e
cmp eax, ebx
jb 0x43a59e
cmp eax, edi
jbe 0x43a65c
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x4b6d84], edx
jne 0x43a587
and esi, 0xffff0000
mov ecx, esi
cmp esi, ebx
jbe 0x43a6fc
lea eax, [ecx - 0x70000000]
mov edx, 0x6fff0000
cmp eax, 0x10000000
lea eax, [ebp - 0x3c]
push 0x1c
cmovbe ecx, edx
push eax
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x43a6fc
mov eax, 0x10000
cmp dword [ebp - 0x2c], eax
jne 0x43a5f5
cmp dword [ebp - 0x30], eax
jae 0x43a607
mov ecx, dword [ebp - 0x38]
add ecx, 0xffff0000
cmp ecx, ebx
ja 0x43a5bb
jmp 0x43a6fc
push 0x40
push 0x3000
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x4b6d84], edx
test edx, edx
je 0x43a6fc
mov eax, dword [0x4b6d7c]
xor ecx, ecx
mov dword [edx + 4], eax
mov esi, 0x7fd
mov dword [edx], 0x52727464
lea eax, [edx + 0xffe0]
mov dword [edx + 8], ecx
mov dword [0x4b6d7c], edx
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
sub esi, 1
jne 0x43a64c
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x43a700
cmp esi, edi
ja 0x43a700
mov ecx, dword [esi + 0x18]
mov eax, 0xcccccccc
mov dword [edx + 8], ecx
mov edi, esi
push 8
pop ecx
rep stosd dword es:[edi], eax
mov eax, esi
jmp 0x43a702
lea eax, [esi - 0x70000000]
mov ecx, 0x80010000
cmp eax, 0x10000000
lea eax, [ebp - 0x20]
push 0x1c
cmovbe esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x43a700
mov eax, 0x10000
cmp dword [ebp - 0x10], eax
jne 0x43a6f4
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jb 0x43a6f7
movzx edx, si
test edx, edx
je 0x43a6d5
mov esi, dword [ebp - 0x20]
sub eax, edx
sub ecx, eax
add esi, eax
mov dword [ebp - 0x14], ecx
mov eax, 0x10000
mov dword [ebp - 0x20], esi
push 0x40
push 0x3000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x4b6d84], edx
test edx, edx
jne 0x43a628
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add esi, ecx
cmp esi, edi
jb 0x43a685
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a76a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4b6d88], 0
je 0x43a77e
mov eax, 0x10dd
jmp 0x43a7d3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x4b6d88
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x43a777
push esi
mov esi, dword [0x4b6d7c]
mov dword [0x4b6d78], eax
mov dword [0x4b6d74], eax
mov dword [0x4b6d80], eax
mov dword [0x4b6d90], eax
mov dword [0x4b6d8c], eax
jmp 0x43a7cc
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x43a7b7
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43a7d7
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4b6d88], eax
je 0x43a7f3
mov eax, 0x10dd
jmp 0x43a87b
push ebx
push esi
push edi
mov edi, dword [0x4b6d74]
xor ebx, ebx
test edi, edi
je 0x43a83d
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x43a82e
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x43a82e
call fcn.0043a709
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push edi
call fcn.00460c6b
mov edi, esi
pop ecx
test esi, esi
jne 0x43a802
mov dword [0x4b6d74], ebx
call fcn.0043a4f5
mov edi, dword [0x4b6d80]
test edi, edi
je 0x43a86a
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push edi
call fcn.00460c6b
mov edi, esi
pop ecx
test esi, esi
jne 0x43a852
pop edi
pop esi
mov dword [0x4b6d80], ebx
xor eax, eax
mov dword [0x4b6d88], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43aad8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
push edi
mov dword [ebp - 0x14], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4b6d88], eax
je 0x43ab02
mov eax, 0x10dd
jmp 0x43aca1
mov eax, dword [0x4b6d90]
test eax, eax
jne 0x43aca1
test ebx, ebx
jne 0x43ab1b
push 6
pop eax
jmp 0x43aca1
mov ecx, dword [ebx]
push esi
test ecx, ecx
jne 0x43ab30
push 6
pop edi
mov dword [0x4b6d90], edi
jmp 0x43ac6f
mov esi, edi
mov ebx, edi
call fcn.0043a72a
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
call fcn.0043a72a
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 4]
jne 0x43ab5d
cmp dword [0x4b6d78], ebx
jne 0x43ac6c
jmp 0x43ac50
push 0x18
call fcn.00460c38
mov ebx, eax
mov dword [ebp - 0x20], ebx
pop ecx
test ebx, ebx
jne 0x43ab76
push 8
pop edi
jmp 0x43ac50
mov ecx, dword [ebp - 4]
call fcn.0043a520
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x43ab6e
mov eax, dword [ebp - 4]
mov ebx, edi
mov dword [ebp - 8], ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], eax
push ecx
push ecx
lea ecx, [ebx + esi]
mov dword [ebp - 0x10], edi
mov edx, eax
call fcn.0043aca9
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x10], edi
jne 0x43abc7
mov ecx, dword [ebp - 8]
mov ebx, eax
sub ebx, edx
call fcn.0043a4aa
test eax, eax
jne 0x43abc7
mov eax, dword [ebp - 0x1c]
cmp ebx, 5
jl 0x43ab8f
mov dword [ebp - 8], ebx
cmp ebx, 5
mov ebx, dword [ebp - 0x20]
jge 0x43abe0
cmp dword [0x4b6d78], 0
push 9
pop edi
jne 0x43ac56
jmp 0x43ac50
mov eax, dword [ebp - 8]
cmp eax, 0x12
jbe 0x43abec
push 6
jmp 0x43ab70
mov ecx, dword [ebp - 0x24]
add edx, eax
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
add esi, 0x17
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov byte [esi], al
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub edx, eax
mov eax, edi
and dword [ebp - 0x24], eax
mov dword [ecx + 1], edx
add ecx, 5
mov edx, esi
sub edx, ecx
cmp ecx, esi
cmova edx, dword [ebp - 0x24]
test edx, edx
je 0x43ac2b
mov byte [ecx], 0xcc
inc ecx
inc eax
cmp eax, edx
jb 0x43ac22
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
push 0x40
push dword [ebp - 8]
mov dword [ebp - 0x18], edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x43ac79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0xc]
mov edi, eax
mov dword [0x4b6d90], edi
test esi, esi
je 0x43ac61
mov ecx, esi
call fcn.0043a709
test ebx, ebx
je 0x43ac6c
push ebx
call fcn.00460c6b
pop ecx
mov ebx, dword [ebp - 0x14]
mov dword [0x4b6d8c], ebx
mov eax, edi
jmp 0x43aca0
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], esi
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x14], eax
mov eax, dword [0x4b6d74]
mov dword [ebx], eax
xor eax, eax
mov dword [0x4b6d74], ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43b7c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx + 4]
push ebx
push esi
push edi
mov ebx, dword [ecx + 0x3c]
xor esi, esi
add ebx, ecx
mov dword [ebp - 4], ecx
xor edi, edi
movzx ecx, word [ebx + 6]
cmp esi, ecx
jae 0x43b819
movzx eax, word [ebx + 0x14]
lea edx, [ebx + 0x18]
add eax, edi
add edx, eax
je 0x43b819
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
add ecx, eax
neg eax
sbb eax, eax
and eax, ecx
cmp eax, dword [ebp + 8]
ja 0x43b808
mov ecx, dword [edx + 8]
add ecx, eax
cmp ecx, dword [ebp + 8]
ja 0x43b80e
inc esi
add edi, 0x28
jmp 0x43b7d6
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43b980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x43b997
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ecx + 4]
push ebx
mov dword [ebp - 8], ecx
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
test eax, eax
je 0x43ba83
lea ebx, [ecx + eax]
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x43ba83
mov edx, dword [ebp + 8]
push edi
cmp edx, 0xffff
ja 0x43b9d5
pop edi
pop ebx
mov word [esi], dx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x43b9e0
xor esi, esi
jmp 0x43b9e3
lea esi, [ecx + eax]
mov eax, dword [ebx + 0x18]
mov edi, esi
mov dword [ebp - 0xc], esi
lea ebx, [esi + eax*4]
cmp esi, ebx
je 0x43ba4c
mov al, byte [edx]
mov byte [ebp - 1], al
mov eax, ebx
sub eax, edi
sar eax, 2
mov eax, eax
test eax, eax
jns 0x43ba07
add eax, 1
sar eax, 1
lea esi, [edi + eax*4]
mov eax, dword [esi]
test eax, eax
je 0x43ba14
add eax, ecx
mov cl, byte [ebp - 1]
test cl, cl
je 0x43ba2d
nop dword [eax + eax]
cmp cl, byte [eax]
jne 0x43ba2d
mov cl, byte [edx + 1]
inc edx
inc eax
test cl, cl
jne 0x43ba20
movzx eax, byte [eax]
movzx ecx, byte [edx]
sub ecx, eax
je 0x43ba57
test ecx, ecx
jle 0x43ba40
lea edi, [esi + 4]
jmp 0x43ba42
mov ebx, esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
cmp edi, ebx
jne 0x43b9f7
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
test eax, eax
je 0x43ba64
add eax, dword [ebp - 8]
sub esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
sar esi, 2
pop edi
pop ebx
mov ax, word [eax + esi*2]
add ax, word [edx + 0x10]
mov word [ecx], ax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x43ba90
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x43baa0
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x43ba9d
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x43ba9d
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete al
ret
Function at 0x43bafd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor edx, edx
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x43bb05
mov dword [edx*4 + 0x4b73a0], ecx
inc edx
cmp edx, 0x100
jb 0x43bb00
mov esi, 0x800
jmp 0x43bb4e
mov ecx, dword [edx*4 + 0x4b6fa0]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x4b73a0]
mov dword [edx*4 + 0x4b73a0], ecx
inc edx
cmp edx, esi
jb 0x43bb32
mov dword [0x4b93a0], 0x43e153
call fcn.0043e394
mov ecx, dword [0x4b93a0]
test eax, eax
mov edx, 0x43e1ec
cmove ecx, edx
mov dword [0x4b93a0], ecx
pop esi
ret

Function at 0x4419bc
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 4
lea eax, [ebp - 8]
mov ebx, ecx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
mov esi, dword [ebp - 8]
xor edi, edi
and esi, 0x3fff
add esi, 0x200
shl esi, 0xa
and esi, 0xffff0000
jbe 0x441a44
push 0x1c
lea eax, [ebp - 0x24]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x441a44
mov ebx, dword [ebp - 0x18]
mov ecx, esi
add ebx, 0xffff
sub ecx, edi
and ebx, 0xffff0000
cmp ecx, ebx
cmovb ebx, ecx
test edi, edi
je 0x441a3b
cmp dword [ebp - 0x14], 0x10000
jne 0x441a3b
push 1
push 0x2000
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add edi, ebx
mov ebx, dword [ebp - 4]
cmp edi, esi
jb 0x4419f2
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x441b2f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call fcn.004150e0
cmp eax, 3
jl 0x441bb8
mov esi, dword [0x4b6da0]
test esi, esi
jne 0x441b8f
push 0x498a1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x441b77
xor al, al
jmp 0x441bba
push str.GetUserDefaultLocaleName
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x4b6da0], esi
test esi, esi
je 0x441b73
mov edi, 0xaa
lea eax, [ebp - 0xb8]
push edi
push 0
push eax
call fcn.00463e50
add esp, 0xc
lea eax, [ebp - 0xb8]
push edi
push eax
call esi
neg eax
sbb eax, eax
neg eax
jmp 0x441bba
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00460c27
mov esp, ebp
pop ebp
ret