joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a360
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f575
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x46d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 4
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [edx], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], 0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x11], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x12], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x13], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x15], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x16], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x17], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0043e6d0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0043e6d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0043e6d0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x10]
add eax, 0x44
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], 0
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov word [ecx + 8], ax
mov edx, dword [ebp - 0x14]
mov byte [edx + 0xa], 0
mov eax, dword [ebp - 0x14]
mov byte [eax + 0xb], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.0040a2b0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0xa8
call fcn.0040a2b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40a590
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f5a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x46d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0xa8
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00420009
add esp, 4
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.00420009
add esp, 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00420009
add esp, 4
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00420009
add esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.00420009
add esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.00420009
add esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.00420009
add esp, 4
mov edx, dword [ebp - 0x10]
add edx, 0xc
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x40a689
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x40a6ba
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 8]
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0
je 0x40a6eb
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 8]
call ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
je 0x40a719
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b290
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f6ee
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x46d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [edx], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 0xc
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 8], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x20], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x21], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0043e6d0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0040a2b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b5f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f759
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x46d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx], 0x468160
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x46811c
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0x468194
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0043e6d0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
add edx, 0x44
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.0040b5a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], 0xffffffff
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x40], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x41], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x42], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x43], 0
xor eax, eax
je 0x40b6cf
mov dword [ebp - 0x14], 1
jmp 0x40b6d6
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x44
push edx
call fcn.0043c7e0
test eax, eax
je 0x40b6ff
mov dword [ebp - 0x24], 0x145ecb
push 0x46a3f0
lea eax, [ebp - 0x24]
push eax
call fcn.00422a20
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40ba60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f788
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x46d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x68
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.0043e610
push 0
mov edx, 0x61
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0043fc70
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043c960
push 0xce4
lea edx, [ebp - 0x3c]
push edx
call fcn.0040ad40
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x6c]
push edx
call fcn.00444f40
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00420009
add esp, 4
push 1
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40bb2f
mov dword [ebp - 0x2c], 1
jmp 0x40bb36
mov dword [ebp - 0x2c], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x40cbd0
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x46d008]
xor eax, ebp
mov dword [ebp + 0x194], eax
xor eax, eax
mov word [ebp - 0x74], ax
push 0x206
push 0
lea ecx, [ebp - 0x72]
push ecx
call fcn.00422a90
add esp, 0xc
push 0x104
lea edx, [ebp - 0x74]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xffffffff
je 0x40cc9c
mov ecx, dword [ebp + 0x1a4]
push ecx
mov edx, dword [ebp - 0x78]
push edx
call fcn.0045e280
mov dword [ebp - 0x80], 0
mov eax, dword [ebp + 0x1a4]
mov ecx, dword [eax]
push ecx
call fcn.00420144
add esp, 4
mov dword [ebp - 0x7c], eax
mov edx, dword [ebp + 0x1a0]
mov eax, dword [ebp - 0x7c]
mov dword [edx], eax
push 0
lea ecx, [ebp - 0x80]
push ecx
mov edx, dword [ebp + 0x1a4]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x1a0]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
call fcn.0041fff8
add ebp, 0x198
mov esp, ebp
pop ebp
ret 8
Function at 0x426639
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x4641e0
push str.FlsAlloc
push 0x1e
call fcn.00426517
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42666d
push dword [ebp + 8]
mov ecx, esi
call dword [0x46225c]
call esi
jmp 0x426673
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4266b7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x464204
push str.FlsGetValue
push 0x20
call fcn.00426517
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4266ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x46225c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x427cc8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x427d65
push ebx
push esi
call fcn.00427c91
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004262de
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x427d12
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x427d64
push edi
push eax
call fcn.00425842
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x427d32
call fcn.00425808
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x427d63
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004262de
add esp, 0x20
test eax, eax
jne 0x427d51
push edi
call fcn.00425808
jmp 0x427d59
push ebx
call fcn.00425808
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42fda0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x42fdd6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x42fee4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x42fdf9
jmp 0x42fdc4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x42fe0f
mov dword [ebp - 0x10], 1
jmp 0x42fe16
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
je 0x42fe32
mov dword [ebp - 0x14], 1
jmp 0x42fe39
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x80000000
je 0x42fe55
mov dword [ebp - 0x18], 1
jmp 0x42fe5c
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20
je 0x42fe7b
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x1c]
shl ecx, 4
mov edx, dword [ebp - 0x20]
lea eax, [ecx + edx*8 + 0x46d890]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x4000000
je 0x42feae
mov edx, dword [ebp - 0xc]
or edx, 0x200
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x42fedf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42fee6
jmp 0x42fdc4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42fef0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x42ff26
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x42ffab
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 1
not edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [ecx + eax - 1]
and ecx, edx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x10]
cmp dword [ebp + 0xc], eax
jb 0x42ff73
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x42ff7a
mov eax, 0xc1
jmp 0x42ffad
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0xc]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.0042ea50
add esp, 0xc
jmp 0x42ff14
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x430010
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x430028
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x43007a
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x430049
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x43006b
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
xor edx, edx
sub edx, ecx
and edx, 0xedb88320
xor eax, edx
mov dword [ebp - 8], eax
jmp 0x430040
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x470920], ecx
jmp 0x43001f
mov dword [ebp - 4], 0x100
jmp 0x43008c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x800
jae 0x4300c4
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x470520]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
and edx, 0xff
mov eax, dword [ebp - 0x10]
shr eax, 8
xor eax, dword [edx*4 + 0x470920]
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x470920], eax
jmp 0x430083
mov dword [0x47090c], 0x430140
mov dword [0x470908], 0x430140
mov esp, ebp
pop ebp
ret
Function at 0x431730
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 8]
shr ecx, 1
add ecx, 3
mov edx, 4
imul eax, edx, 0
mov edx, dword [ebp - 8]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x431786
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jae 0x43179e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [edx + ecx*4], eax
jmp 0x431774
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp + 8], 3
mov edx, dword [ebp - 8]
lea eax, [edx + ecx*4 + 0x70]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
jne 0x43183d
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
xor edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
shl ecx, 8
or edx, ecx
mov eax, dword [ebp - 4]
shr eax, 0x18
movzx ecx, byte [eax + str.cw]
shl ecx, 0x10
or edx, ecx
mov eax, dword [ebp - 4]
and eax, 0xff
movzx ecx, byte [eax + str.cw]
shl ecx, 0x18
or edx, ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0xc]
shl edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x100
je 0x431835
mov dword [ebp - 0xc], 0x1b
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
jmp 0x43189e
cmp dword [ebp - 0x10], 4
jne 0x43189e
cmp dword [ebp + 8], 6
jbe 0x43189e
mov edx, dword [ebp - 4]
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
shl edx, 8
or eax, edx
mov ecx, dword [ebp - 4]
shr ecx, 0x10
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
shl edx, 0x10
or eax, edx
mov ecx, dword [ebp - 4]
shr ecx, 0x18
movzx edx, byte [ecx + str.cw]
shl edx, 0x18
or eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, dword [eax + edx]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + edx*4], ecx
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1c]
jne 0x4317c0
mov esp, ebp
pop ebp
ret 4
Function at 0x433cb0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x268]
sub esp, 0x2e8
mov eax, dword [0x46d008]
xor eax, ebp
mov dword [ebp + 0x264], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
cmp eax, 6
je 0x433d0a
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x433d0a
push 0xc00
call dword [ebp - 0x80]
test eax, eax
je 0x433d0a
jmp 0x433e18
push 0x106
lea ecx, [ebp - 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
je 0x433d2b
cmp dword [ebp - 0x78], 0x104
jbe 0x433d30
jmp 0x433e18
mov edx, dword [ebp - 0x78]
movzx eax, word [ebp + edx*2 - 0x6e]
cmp eax, 0x5c
je 0x433d53
mov ecx, 0x5c
mov edx, dword [ebp - 0x78]
mov word [ebp + edx*2 - 0x6c], cx
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
mov ecx, dword [str.userenv]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
movsx eax, byte [edx]
test eax, eax
je 0x433e18
mov ecx, dword [ebp - 0x78]
lea edx, [ebp + ecx*2 - 0x6c]
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x7c]
mov cl, byte [eax]
mov byte [ebp - 0x6d], cl
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
movsx eax, byte [ebp - 0x6d]
test eax, eax
jne 0x433d8f
jmp 0x433da5
movzx cx, byte [ebp - 0x6d]
mov edx, dword [ebp - 0x74]
mov word [edx], cx
mov eax, dword [ebp - 0x74]
add eax, 2
mov dword [ebp - 0x74], eax
jmp 0x433d74
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x2e
mov ecx, dword [ebp - 0x74]
mov word [ecx + edx], ax
mov edx, 2
shl edx, 0
mov eax, 0x64
mov ecx, dword [ebp - 0x74]
mov word [ecx + edx], ax
mov edx, 2
shl edx, 1
mov eax, 0x6c
mov ecx, dword [ebp - 0x74]
mov word [ecx + edx], ax
mov edx, 2
imul eax, edx, 3
mov ecx, 0x6c
mov edx, dword [ebp - 0x74]
mov word [edx + eax], cx
mov eax, 2
shl eax, 2
xor ecx, ecx
mov edx, dword [ebp - 0x74]
mov word [edx + eax], cx
push 8
push 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x433d5c
mov ecx, dword [ebp + 0x264]
xor ecx, ebp
call fcn.0041fff8
add ebp, 0x268
mov esp, ebp
pop ebp
ret
Function at 0x43bc10
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0x6a09e667
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0xbb67ae85
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x20], 0x3c6ef372
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x20], 0xa54ff53a
mov edx, 4
shl edx, 2
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0x510e527f
mov ecx, 4
imul edx, ecx, 5
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0x9b05688c
mov ecx, 4
imul edx, ecx, 6
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0x1f83d9ab
mov ecx, 4
imul edx, ecx, 7
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0x5be0cd19
pop ebp
ret 4

Function at 0x43c9a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call fcn.00424214
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0043c8a0
mov esp, ebp
pop ebp
ret 0xc