joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dee0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
mov esi, ecx
cmp word [esi], 0x5c
je 0x40df22
cmp word [esi + 2], 0x3a
je 0x40df22
push 0x5a1088
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x40df2e
push esi
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 7
push 1
push 0
push 1
push 0x40000000
lea eax, [esp + 0x20]
push eax
call fcn.0044c890
mov esi, eax
cmp esi, 0xffffffff
je 0x40df8a
mov edx, dword [esp + 0x410]
push 0
lea ecx, [esp + 8]
push ecx
push edx
push edi
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x5a0e4c
push 0x5a0e44
push 0x5a0e3c
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x408]
pop esi
xor ecx, esp
call fcn.0043afb6
add esp, 0x408
ret
Function at 0x40e690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44e958
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, 0x59ffc4
lea esi, [esp + 0xc]
call fcn.0040eba0
mov edi, 1
mov dword [esp + 0x30], edi
lea eax, [esp + 0x10]
push eax
call fcn.00402dd0
mov byte [esp + 0x30], 2
cmp dword [ebp + 8], 0
je 0x40e744
mov eax, dword [esp + 0xc]
cmp dword [eax - 4], edi
mov esi, dword [eax - 0xc]
jle 0x40e704
mov ecx, esi
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.0040b160
mov eax, dword [esp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
push esi
push eax
call fcn.0043b24b
mov edx, dword [esp + 0x1c]
add esp, 0x10
test edx, edx
jne 0x40e722
xor eax, eax
jmp 0x40e734
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40e727
sub eax, esi
js 0x40e7a9
cmp eax, dword [edx - 8]
jg 0x40e7a9
mov dword [edx - 0xc], eax
mov ecx, dword [esp + 0xc]
mov byte [eax + ecx], 0
push 0x457a24
push 0x457a24
lea edx, [esp + 0x14]
push edx
call fcn.0040a090
test ebx, ebx
mov eax, dword [esp + 0xc]
je 0x40e818
cmp dword [eax - 0xc], 0
mov esi, vtable._com_error.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
je 0x40e7b3
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov byte [esp + 0x30], 3
lea edi, [esp + 0x14]
call fcn.0040e280
mov ecx, dword [esp + 0xc]
push eax
push ebx
push ecx
push str._s_n0x_x__s_n
lea edi, [esp + 0x20]
call fcn.0040ec10
add esp, 0x10
jmp 0x40e7de
push 0x80070057
call fcn.00402920
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov byte [esp + 0x30], 4
lea edi, [esp + 0x14]
call fcn.0040e280
push eax
push ebx
push str.0x_x__s_n
lea edi, [esp + 0x1c]
call fcn.0040ec10
add esp, 0xc
mov byte [esp + 0x30], 2
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x14], esi
je 0x40e7f7
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
cmp dword [esp + 0x20], 0
je 0x40e830
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x40e830
mov ecx, dword [esp + 0x20]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40e830
cmp dword [eax - 0xc], 0
je 0x40e830
push eax
push 0x457a40
lea edi, [esp + 0x18]
call fcn.0040ec10
add esp, 8
cmp dword [0x5a1bd4], 0
je 0x40e848
mov edx, dword [esp + 0x10]
push edx
call fcn.0043b434
add esp, 4
jmp 0x40e85c
mov eax, dword [esp + 0x10]
push 0x10
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [esp + 0x30], 1
lea ecx, [esp + 0x10]
call fcn.00402e30
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00402e30
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4503ef
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebp
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3c]
xor ebp, ebp
mov dword [edi], vtable.CHVMEEHlpr.0
mov dword [edi + 0x58], ebp
mov dword [edi + 0x5c], ebp
mov dword [edi + 0x60], ebp
mov dword [esp + 0x34], ebp
mov dword [edi + 0x84], ebp
mov dword [edi + 0x88], ebp
mov dword [edi + 0x8c], ebp
mov byte [esp + 0x34], 1
lea eax, [edi + 0x9c]
push eax
call fcn.00402dd0
mov byte [esp + 0x34], 2
lea ecx, [edi + 0xa0]
push ecx
call fcn.00417d00
mov byte [esp + 0x34], 3
lea edx, [edi + 0xac]
push edx
call fcn.004350c0
mov byte [esp + 0x34], 4
lea eax, [edi + 0x1bc]
push eax
call fcn.00417d00
mov byte [esp + 0x34], 5
mov eax, 5
mov esi, 1
push 0x88
mov dword [edi + 0x48], ebp
mov dword [edi + 0x4c], ebp
mov dword [edi + 0x20], ebp
mov dword [edi + 4], ebp
mov dword [edi + 0x50], ebp
mov dword [edi + 0x44], ebp
mov dword [edi + 0x1b8], ebp
mov dword [edi + 0x1b4], ebp
mov dword [edi + 0x1cc], ebp
mov dword [edi + 0x1d0], ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c8], ebp
mov dword [edi + 0x40], ebp
mov dword [edi + 0x1d4], ebx
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x28], 0x13
mov dword [esp + 0x2c], 0x16
mov dword [edi + 0x134], 0x3000000
mov dword [edi + 0x138], 0x5000000
mov dword [edi + 0x13c], 0x7000000
mov dword [edi + 0x140], 0x13000000
mov dword [edi + 0x144], 0x16000000
mov dword [edi + 0x148], eax
mov dword [edi + 0x14c], esi
mov dword [edi + 0x150], esi
mov dword [edi + 0x160], ebp
mov dword [edi + 0x1a8], ebp
mov dword [edi + 0x164], ebp
mov dword [edi + 0x154], ebp
mov dword [edi + 0x1a0], ebp
mov dword [edi + 0x6c], ebp
mov dword [edi + 0x78], ebp
mov dword [edi + 0x70], ebp
mov dword [edi + 0x68], ebp
mov dword [edi + 0x24], ebp
mov dword [edi + 0x28], ebp
call fcn.0043b517
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x34], 6
cmp eax, ebp
je 0x4155b3
mov esi, eax
call fcn.004150b0
mov edx, eax
lea esi, [ebp + 1]
jmp 0x4155b5
xor edx, edx
mov byte [esp + 0x34], 5
mov eax, ebx
mov dword [edi + 0xc], edx
call fcn.00415150
mov ecx, dword [edi + 0xc]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x7c], esi
mov dword [edi + 0x64], ebp
mov dword [edi + 0x1ac], ebp
mov dword [edi + 0x1b0], ebp
mov dword [edi + 0x98], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x18]
xor eax, edx
mov ecx, eax
shl ecx, 6
mov dword [edi + 0x30], eax
sub ecx, eax
mov eax, dword [0x5a1bf4]
mov dword [edi + 0x38], ecx
mov edx, dword [eax + 0x24]
xor edx, ecx
mov dword [edi + 0x38], edx
mov dword [esp + 0x34], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4

Function at 0x419500
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push 0x4589ac
jmp loc.00720f5b
Function at 0x419990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44e1a6
mov eax, dword fs:[0]
push eax
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax], vtable.IJitCallBack.0
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [esp + 0xc], ecx
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
mov dword [eax + 0x78], ecx
mov byte [esp + 0xc], 1
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4

Function at 0x41a030
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450d05
mov eax, dword fs:[0]
push eax
sub esp, 0x270
push ebx
push esi
push edi
mov eax, dword [0x46b070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x4589e8
jmp fcn.006e8a9a

Function at 0x41c7de
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esi, 4
mov ecx, dword [esi]
xor ecx, ebx
call fcn.005eb5ae
adc ebp, 4
xor edx, ebx
rol edx, cl
shr ecx, cl
neg edx
shl cl, 0x27
movzx eax, cx
call fcn.0066b584
mov ecx, 0xc61e873f
neg ecx
mov ax, word [edi + ecx*2 - 0x73c2f182]
mov dx, word [edi + ecx*2 - 0x73c2f180]
shr cx, cl
call fcn.006cca81
mov eax, 0x94035929
mov ecx, dword [edi]
dec al
cwde
mov eax, dword [edi + eax*2 - 0xb24c]
jge 0x5e4241
push ecx
pushfd
mov ecx, 0x84041db4
push ebp
mov ebp, 0x132210a3
not cx
sub ecx, 0xbd0d821b
mov ecx, dword [esp + ebp*4 - 0x4c884284]
mov dword [esp + 8], 0x116306da
mov ebp, dword [esp + ebp*2 - 0x26442146]
call fcn.005cf1c2
jmp loc.0072a992
imul ecx
mov ecx, 0xb4330633
add cx, cx
ror cx, cl
mov dword [edi], edx
bswap ecx
bt cx, cx
lea ecx, [ecx + ecx*4 - 0x70cb4d43]
mov dword [edi + 4], eax
mov eax, dword [esi]
mov edx, 0xdf87291e
adc esi, 3
xor eax, ebx
bts edx, ecx
inc eax
and ecx, ecx
add cl, cl
imul edx, ecx
bswap eax
setb cl
lea edx, [ecx*2 - 0x4adb69e2]
adc eax, 0x135c79e
lea edx, [ecx*2 + 0x1c1b8532]
not dl
xor eax, 0xf49c831c
jmp 0x6a6f9d
inc eax
xor eax, 0xf1b5b21a
ror dx, cl
call fcn.006ed2e8
sub ebp, 4
mov ecx, 0x10294dab
lea edx, [ecx + ecx*8 - 0x4b7417e0]
mov ecx, dword [ecx + ebp - 0x10294dab]
shl edx, 0xc3
movsx eax, dl
shr edx, 0xbf
xor ecx, ebx
dec ecx
lea edx, [eax + eax - 0x18cf0171]
bswap ecx
lea ecx, [ecx + edx - 0x3683f324]
ror ecx, 1
xor ecx, 0xfbaa2db3
xor ebx, ecx
xadd dx, ax
sub edx, eax
adc edi, ecx
btr edx, 0x2c
bts ax, dx
mov edx, dword [esi + eax - 0xffbf]
mov eax, dword [esi + eax*4 - 0x3fef8]
mov ecx, 0x83856414
imul ecx, ecx
mov cl, byte [esi + 8]
jo 0x62e41f
Function at 0x423180
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push edi
push 0x45a4b4
jmp fcn.0067a782

Function at 0x42ab90
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x451068
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x45a948
jmp fcn.00627e58

Function at 0x42b3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450fdd
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, ecx
push 0x45a974
mov dword [esp + 0x1c], edi
mov dword [esp + 0x30], eax
jmp fcn.00713bcd

Function at 0x42b850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4505b5
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00419990
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x30]
mov dword [esi], vtable.NetFX45::CNetFX4xCallBack.0
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], ebx
mov dword [esi + 0x94], edi
mov byte [esp + 0x14], 1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
mov eax, dword [0x5a1cc4]
mov dword [esi + 0xa8], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x98], ecx
mov ecx, dword [eax + 0x3c]
add ecx, dword [eax + 0x34]
mov eax, dword [0x5a138c]
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 8], ebx
mov ecx, dword [esi + 0x94]
cmp ecx, edi
mov dword [esi + 0x8c], edx
mov dword [esi + 0x90], eax
je 0x42b904
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x94], edi
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xac], ecx
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x18

Function at 0x42bcf0
Capabilities:
Create thread

Disassembly:
sub esp, 8
push 0x45a9b4
jmp fcn.005c17c6
Function at 0x433180
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
and di, bx
mov edx, dword [0x5a1bf4]
sbb ecx, esi
ror cx, cl
mov eax, dword [edx + 0x44]
dec cx
stc
xor eax, esi
mov ecx, dword [ebx + 0x164]
shl di, 0x23
mov edi, 0x91305183
shr ecx, 4
sbb edi, 0x218daab6
test di, 0xf707
rcr edi, 0xa0
and ecx, 0x20
jmp loc.005a8015
push ebp
lea ebp, [esp - 0x104]
sub esp, 0x104
push 0xffffffffffffffff
push 0x450fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp + 0x100], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x10c]
mov dword [ebp - 0x28], ebx
mov esi, dword [ebp + 0x110]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 0x114]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
push 0x45ee68
jmp 0x42353a

Function at 0x4345f5
Capabilities:
Set environment variable
Set registry value

Disassembly:
neg dl
mov dword [esp + ecx*2 - 0x77320004], ecx
inc dl
neg dword [esp + ecx - 0x3b990002]
sub eax, eax
xor bl, dl
lea edx, [esp + edx + 4]
or ax, word [edx + eax]
mov edx, dword [esp + ecx - 0x3b990002]
or dx, dx
lea ebp, [ebp + ecx*2 - 0x77320006]
and dx, 0x51e
mov word [ebp + ecx*2 - 0x77320004], ax
lea eax, [edx + edx*4 + 0x508510b]
pop eax
jae fcn.006d770b
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]

Function at 0x4350c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44ffbc
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
push esi
call fcn.00417d00
mov dword [esp + 0x10], 0
lea eax, [esi + 0xc]
push eax
call fcn.00417d00
mov byte [esp + 0x10], 1
lea ecx, [esi + 0x18]
push ecx
call fcn.00417d00
mov byte [esp + 0x10], 2
lea edx, [esi + 0x24]
push edx
call fcn.00417d00
mov byte [esp + 0x10], 3
lea eax, [esi + 0x30]
push eax
call fcn.00417d00
mov byte [esp + 0x10], 4
lea ecx, [esi + 0x3c]
push ecx
call fcn.00417d00
mov byte [esp + 0x10], 5
lea edx, [esi + 0x48]
push edx
call fcn.00417d00
mov byte [esp + 0x10], 6
lea eax, [esi + 0x54]
push eax
call fcn.00417d00
mov byte [esp + 0x10], 7
lea ecx, [esi + 0x60]
push ecx
call fcn.00417d00
mov byte [esp + 0x10], 8
lea edx, [esi + 0x6c]
push edx
call fcn.00417d00
mov byte [esp + 0x10], 9
lea eax, [esi + 0x7c]
push eax
call fcn.00417d00
mov byte [esp + 0x10], 0xa
mov dword [esi + 0x78], 1
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4351b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44ff14
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov ecx, 9
mov dword [esp + 0x14], ecx
lea eax, [esi + 0x7c]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 8
mov byte [esp + 0x14], cl
lea eax, [esi + 0x6c]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 7
mov byte [esp + 0x14], cl
lea eax, [esi + 0x60]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 6
mov byte [esp + 0x14], cl
lea eax, [esi + 0x54]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 5
mov byte [esp + 0x14], cl
lea eax, [esi + 0x48]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 4
mov byte [esp + 0x14], cl
lea eax, [esi + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 3
mov byte [esp + 0x14], cl
lea eax, [esi + 0x30]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 2
mov byte [esp + 0x14], cl
lea eax, [esi + 0x24]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 1
mov byte [esp + 0x14], cl
lea eax, [esi + 0x18]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
xor cl, cl
mov byte [esp + 0x14], cl
lea eax, [esi + 0xc]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
call fcn.004181f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x435440
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push 0x45efd8
mov ebx, eax
mov esi, ecx
jmp fcn.006e589b
Function at 0x4367b0
Capabilities:
Parse pe header

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, ecx
push 0x40
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x4367d0
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
cmp word [edi], 0x5a4d
jne 0x4367c9
push esi
mov esi, dword [edi + 0x3c]
push 4
add esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4368a3
cmp dword [esi], 0x4550
jne 0x4368a3
mov dword [ebp], eax
mov dword [ebx], eax
cmp word [esi + 0x18], 0x20b
mov ecx, dword [esi + 0x50]
mov dword [esp + 0x10], eax
jne 0x43681e
mov eax, dword [esi + 0xf8]
mov dword [esp + 0x10], 1
jmp 0x436824
mov eax, dword [esi + 0xe8]
test eax, eax
mov dword [ebp], ecx
mov edx, dword [esi + 8]
mov dword [ebx], edx
je 0x4368a3
cmp dword [esp + 0x18], 0
lea ebx, [eax + edi]
jne 0x436855
cmp dword [esp + 0x10], 0
push edi
mov ecx, esi
je 0x43684b
call fcn.004128b0
jmp 0x436850
call fcn.004128b0
mov ebx, eax
add esp, 4
push 0x48
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4368a3
mov eax, dword [ebx + 8]
sub eax, 0x10
cmp dword [esp + 0x18], 0
lea ebp, [eax + edi]
jne 0x43688d
cmp dword [esp + 0x10], 0
push edi
mov ecx, esi
je 0x436883
call fcn.004128b0
jmp 0x436888
call fcn.004128b0
mov ebp, eax
add esp, 4
push 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4368a3
cmp dword [ebp], 0x424a5342
je 0x4368ab
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
mov esi, 1
xor edi, edi
add ecx, esi
lea ebx, [esi + 0x1e]
jmp 0x4368c0
movzx eax, byte [ecx - 1]
add eax, esi
xor edx, edx
mov esi, 0xfff1
div esi
add ecx, 4
mov esi, edx
lea eax, [edi + esi]
xor edx, edx
mov edi, 0xfff1
div edi
movzx eax, byte [ecx - 4]
add eax, esi
mov esi, 0xfff1
mov edi, edx
xor edx, edx
div esi
mov esi, edx
lea eax, [edi + esi]
xor edx, edx
mov edi, 0xfff1
div edi
movzx eax, byte [ecx - 3]
add eax, esi
mov esi, 0xfff1
mov edi, edx
xor edx, edx
div esi
mov esi, edx
lea eax, [edi + esi]
xor edx, edx
mov edi, 0xfff1
div edi
movzx eax, byte [ecx - 2]
add eax, esi
mov esi, 0xfff1
mov edi, edx
xor edx, edx
div esi
mov esi, edx
lea eax, [edi + esi]
xor edx, edx
mov edi, 0xfff1
div edi
sub ebx, 1
mov edi, edx
jne 0x4368c0
mov eax, edi
shl eax, 0x10
add eax, esi
sub eax, dword [ebp + 0xc]
pop esi
neg eax
sbb eax, eax
not eax
pop edi
and eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x436960
Capabilities:
Encode data using base64
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x49c]
sub esp, 0x49c
push 0xffffffffffffffff
push 0x450783
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp + 0x498], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x4a4]
mov dword [ebp - 0x58], eax
mov eax, dword [0x5a1bf4]
add eax, 0xa0
mov dword [ebp - 0x3c], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x38], 1
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x4a8]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x28], eax
mov esi, dword [0x5a1bf4]
add esi, 0x68
lea ebx, [ebp - 0x4c]
lea eax, [ebp + 0x480]
call fcn.00437f90
mov ebx, dword [esi + 4]
mov edi, dword [ebp + 0x480]
test edi, edi
je 0x4369fc
cmp edi, esi
je 0x436a01
call fcn.0043b6ab
mov esi, dword [ebp + 0x484]
cmp esi, ebx
je 0x436a1e
test edi, edi
jne 0x436a14
call fcn.0043b6ab
cmp esi, dword [edi + 4]
jne 0x436a1e
call fcn.0043b6ab
mov byte [ebp - 4], 1
push 0x45f0c8
jmp 0x5ebc34
Function at 0x437162
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jb 0x74304d
sbb edx, ecx
sub ebx, edx
lea esp, [esp + 4]
call fcn.0074db13
bt ecx, ecx
mov word [edx + ecx*2 - 0x5e7da460], ax
jae 0x6142cf
je 0x5cfbd7
mov dword [esi + 0x1c], eax
sub edx, 0x7c3793a2
cdq
mov edi, dword [eax]
rdtsc
shl ch, 0x95
cdq
mov eax, dword [edi]
shr ch, 0x1a
shl ecx, 0x25
sub eax, dword [esi + 0x34]
test di, 0x3f96
cdq
add ecx, 0x290d583b
and cx, 0x72a7
xor eax, edx
sub eax, edx
mov ecx, esp
mov dword [esi + 0x3c], eax
mov ecx, dword [edi]
jmp 0x7007b8
push eax
jmp 0x6d829a
shl eax, 0x6a
mov eax, dword [eax + esi - 0x79aec7fc]
imul ecx
sal word [esp + 1], 0x6a
mov dword [esi], edx
neg dword [esp]
mov dword [esi + 4], eax
mov ecx, 0xc3aef9bb
neg cl
pop eax
jmp edi
mov eax, dword [ebp]
jmp 0x5a6298
xor ebx, ecx
add ebp, ecx
lea ecx, [eax*8 + 0x2a18d2b7]
sal ecx, 0xca
jmp ebp
mov ecx, dword [esi + ecx - 0x2f3ed230]
mov eax, 0x6bb890b
mov edx, 0xdcb78733
sal edx, 0xeb
lea esi, [esi + eax - 0x6bb8907]
bt edx, edx
xor dx, 0x321c
xor ecx, ebx
dec dx
setno al
xor ecx, 0x473b30b1
btc dx, 0xb8
jae 0x741f0c
call fcn.006f6af4
shr dword [esp], cl
neg edx
sar ecx, 0x31
bts ecx, 2
inc edx
dec dword [esp]
ror ecx, 0xa7
jae 0x667c0d
neg edx
shr ax, cl
shl byte [esp + ecx - 0x3bffffe6], 0x81
or word [esp + ecx - 0x3bffffe5], ax
not edx
jns 0x6d2b2d
xor ebx, edx
add edi, edx
cdq
imul edx
pop edx
jno fcn.005d0be1
sbb edi, 2
sar cl, 0xe6
movsx edx, cl
mov word [edx + edi], ax
mov eax, edx
xadd dl, dh
call fcn.007205ad
call fcn.005f8363
call fcn.0040ec10
lea edx, [ebp - 0x70]
movzx ecx, si
movsx ecx, cx
movsx cx, ah
push edx
bswap ecx
mov ecx, edi
xchg dh, dl
movsx edx, dx
mov edx, str.This_application_occurred_a_problem._n
jmp 0x73076b
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
bsf ebp, ecx
shr ebp, 0xa
pop ebp
sar bh, cl
sub ebx, esi
pop ebx
add esp, 0x1c
ret
call fcn.00434990
add esp, 0x24
mov byte [ebp - 4], 8
sbb ch, 0x97
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
add esi, ebp
mov esi, dword [ebp - 0x14]
test dx, cx
jmp 0x4308e3
neg ecx
rol ax, 0xd
cmovb edx, eax
adc eax, eax
sbb ecx, 0x7aae981e
rol ecx, 2
add dx, dx
jl 0x5d9109
add edi, edx
mov ecx, dword [esi + eax - 0x639e6bb2]
rol dword [esp + eax - 0x639e6bb2], 0xe1
jno 0x5bd12d
xor edx, ebx
inc edx
btr eax, eax
inc al
bswap edx
rol edx, 1
dec ecx
inc edx
imul ax, cx
xor ebx, edx
bts ecx, ecx
add edi, edx
fld qword [ecx + esi - 0xd425]
jmp edi

Function at 0x437aa3
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports
Set environment variable

Disassembly:
mov eax, dword [esi]
mov ecx, 0xf218760e
mov dword [esp], ecx
add esi, 4
push ecx
shl dword [esp + 3], 0xba
movzx edx, word [esp + 4]
xor eax, ebx
jmp fcn.0060b954