joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c994
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ca07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404024
mov dword [ebp - 8], 0x1e
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404670
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004044e4
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x43c9f1
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ca0e
lea eax, [ebp - 4]
call fcn.00404024
ret

Function at 0x43ca14
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044d4
xor eax, eax
push ebp
push 0x43cb29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404024
xor ecx, ecx
push ebp
push 0x43cb09
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 4]
call fcn.00408224
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x43cafa
mov edx, dword [eax + 0xc]
test edx, edx
je 0x43cafa
mov esi, dword [edx]
test esi, esi
je 0x43cafa
push ebx
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x298], 0
lea edx, [ebp - 0x2b4]
mov ecx, 3
mov eax, 0x43cb40
call fcn.00408798
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cb13
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cb30
lea eax, [ebp - 4]
call fcn.00404024
ret

Function at 0x43cdd0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
mov ebx, eax
mov edx, ebx
mov eax, 0x43ce70
call fcn.0043e5bc
xor edx, edx
push ebp
push 0x43ce54
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x43ce45
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.0040421c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ce5e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d7f0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43d8e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004042e4
cmp eax, 2
jl 0x43d8ce
mov eax, ebx
call fcn.00408008
test al, al
je 0x43d8ce
lea ecx, [ebp - 8]
mov edx, 0x43d904
mov eax, ebx
call fcn.0043d768
xor eax, eax
push ebp
push 0x43d8c4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.004044e4
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43d8ba
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004080b0
mov eax, dword [ebp - 0xc]
call fcn.004042e4
mov edi, eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
call fcn.0040453c
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43d8ce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d8f0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404048
ret

Function at 0x43da14
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43daeb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004042e4
cmp eax, 2
jl 0x43dad5
xor eax, eax
push ebp
push 0x43dacb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, ebx
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x43dac1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004080b0
mov eax, dword [ebp - 8]
call fcn.004042e4
mov edi, eax
inc edi
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
call fcn.0040453c
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
call fcn.004044e4
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43dad5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43daf2
lea eax, [ebp - 8]
call fcn.00404024
ret

Function at 0x43dbf8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.00404024
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x43dc26
mov edx, ebx
lea eax, [esp + 4]
call fcn.004082f4
add esp, 0x18
pop ebx
ret
Function at 0x43e154
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
cmp edx, 0
jne 0x43e1a1
cmp eax, 0xffffffff
jne 0x43e1a1
mov byte [ebp - 1], 1
jmp 0x43e31e
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e1d0
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4e]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43e1d0
mov bl, 1
test bl, bl
jne 0x43e1dd
mov byte [ebp - 1], 1
jmp 0x43e31e
xor ebx, ebx
cmp word [ebp - 0x4e], 0x5a4d
je 0x43e1ed
cmp dword [ebp - 8], 0x40
jne 0x43e23f
push 0
push 0
mov eax, dword [ebp - 0x12]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e23f
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x146]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43e23f
mov eax, dword [ebp - 0x146]
cmp eax, 0x4550
je 0x43e23d
cmp eax, 0x454e
je 0x43e23d
cmp eax, 0x454c
jne 0x43e23f
mov bl, 1
test bl, bl
je 0x43e315
xor eax, eax
push ebp
push 0x43e30b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043e0ac
mov dword [ebp - 0x13e], eax
call fcn.00402ab0
mov eax, 9
call fcn.00402ca8
mov word [ebp - 0x102], ax
mov eax, 9
call fcn.00402ca8
mov word [ebp - 0x100], ax
push 0
push 0
mov eax, dword [ebp - 0x12]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e2c1
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x146]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp word [ebp - 0x4e], 0x5a4d
je 0x43e301
mov word [ebp - 0xe], 0x5a4d
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43e301
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e315
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43e4c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404024
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004065bc
test eax, eax
je 0x43e4ad
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404294
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.0040c104
mov edx, dword [ebp - 0x110]
mov eax, ebx
call fcn.00404078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e4cd
lea eax, [ebp - 0x110]
call fcn.00404024
ret

Function at 0x43e538
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43e5b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404294
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c104
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.00404078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e5b7
lea eax, [ebp - 0x10c]
call fcn.00404024
ret

Function at 0x43e5bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43e636
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404024
mov eax, dword [ebp - 4]
call fcn.004042e4
mov esi, eax
test esi, esi
jle 0x43e620
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.0040420c
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004042ec
inc dword [ebp - 8]
dec esi
jne 0x43e5f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e63d
lea eax, [ebp - 0xc]
call fcn.00404024
ret

Function at 0x43eb08
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call fcn.00402c88
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.00402c88
mov dword [esp], 0x44
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push edi
push 0
push 0x20
push 0
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret
Function at 0x43eb64
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ecca
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, edi
call fcn.00404024
lea eax, [ebp - 0x24]
push eax
mov eax, ebx
call fcn.004044e4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43eca7
mov eax, dword [ebp - 0xc]
call fcn.004026e8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x43ec9f
xor eax, eax
push ebp
push 0x43ec95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x43ecd8
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x43ec8b
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov edx, 4
call fcn.00407ba0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00406568
movzx eax, ax
lea ecx, [ebp - 0x18]
mov edx, 4
call fcn.00407ba0
push 0x43ecfc
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0x43ed18
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004043a4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404330
mov eax, dword [ebp - 0x28]
call fcn.004044e4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x43ec8b
mov eax, edi
mov edx, dword [ebp - 0x20]
call fcn.0040421c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ec9f
mov eax, dword [ebp - 8]
call fcn.00402708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ecd1
lea eax, [ebp - 0x28]
call fcn.00404024
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404048
ret
Function at 0x43f778
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x43f873
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 8]
mov eax, 0x43f88c
call fcn.0043e5bc
lea eax, [ebp - 8]
mov edx, edi
call fcn.004042ec
mov eax, dword [ebp - 8]
call fcn.004044e4
mov esi, eax
xor edx, edx
push ebp
push 0x43f853
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x43f7f2
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f85d
mov eax, edi
call fcn.004044e4
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x43f822
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f85d
push esi
push 0xffffffffffffffff
push 0
call fcn.004062c8
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x43f83f
cmp eax, 5
jne 0x43f849
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f85d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f87a
lea eax, [ebp - 8]
call fcn.00404024
ret
Function at 0x43f894
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x150], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x43fa20
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dword [esi], 2
mov eax, edi
call fcn.00404024
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43fa02
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43f9fc
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43f9fc
cmp word [ebp - 0x50], 0x5a4d
jne 0x43f9fc
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43f9fc
push 0
lea eax, [ebp - 0xc]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43f9fc
cmp dword [ebp - 0x148], 0x4550
jne 0x43f9fc
mov eax, dword [ebp - 0x140]
xor eax, 0x50485e00
xor eax, dword [ebp - 0x120]
movzx edx, word [ebp - 0x142]
xor eax, edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 2
jne 0x43f9af
call fcn.0043c774
add eax, 0x7c6
xor dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jle 0x43f9c9
cmp dword [ebp - 0x10], 0x7a120
jge 0x43f9c9
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov byte [ebp - 5], 1
jmp 0x43f9fc
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x10]
call fcn.00407a8c
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x43fa3c
call fcn.0043e5bc
mov edx, dword [ebp - 0x150]
mov eax, edi
pop ecx
call fcn.00404330
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fa27
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.00404048
ret
Function at 0x43fa6c
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x43fc2a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004044e4
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x43fc0e
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43fc08
cmp word [ebp - 0x4c], 0x5a4d
jne 0x43fc08
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43fc08
cmp dword [ebp - 0x144], 0x4550
jne 0x43fc08
call sub.kernel32.dll_GetCurrentProcessId
add eax, 0x7c6
xor eax, dword [ebp - 0x13c]
mov dword [ebp - 0x13c], eax
call fcn.00402ab0
mov eax, 9
call fcn.00402ca8
mov word [ebp - 0x100], ax
mov eax, 9
call fcn.00402ca8
mov word [ebp - 0xfe], ax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fbac
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp byte [ebp - 1], 0
je 0x43fc08
mov eax, 0x200
call fcn.00402ca8
mov edi, eax
shl edi, 4
test edi, edi
jle 0x43fc08
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x43fc08
push edi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x43fa48]
call fcn.004053ac
add esp, 4
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00406574
push 0
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fc31
lea eax, [ebp - 0xc]
mov edx, dword [0x43fa48]
call fcn.004053b8
ret

Function at 0x442670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4426ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404024
mov eax, dword [ebp - 4]
call fcn.004042e4
mov esi, eax
test esi, esi
jle 0x4426d7
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040420c
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004042ec
inc dword [ebp - 0xc]
dec esi
jne 0x4426b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4426f4
lea eax, [ebp - 0x10]
call fcn.00404024
ret
Function at 0x4443f8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x444400
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x444629
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push esi
call sub.kernel32.dll_GlobalFindAtomA
mov word [0x44bd90], ax
cmp word [0x44bd90], 0
jne 0x4445f0
call fcn.00402ab0
mov eax, dword [0x449d04]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
call fcn.00402ca8
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov eax, dword [0x449d04]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.0043d6d4
push dword [ebp - 0x18]
push 0x444644
lea eax, [ebp - 4]
mov edx, 3
call fcn.004043a4
mov eax, dword [ebp - 4]
call fcn.00408198
test al, al
jne 0x44449f
lea eax, [ebp - 4]
mov edx, dword [0x44a050]
mov edx, dword [edx]
call fcn.004040bc
lea edx, [ebp - 0xc]
mov eax, dword [0x44a11c]
mov eax, dword [eax]
call fcn.004080b0
mov eax, dword [ebp - 0xc]
call fcn.004042e4
cmp eax, 0x13
jle 0x4444c8
lea edx, [ebp - 0xc]
mov eax, 0x444650
call fcn.0043e5bc
mov al, byte [0x44465c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x444668
mov edx, 0x444678
mov eax, dword [ebp - 0xc]
call fcn.0040cbc0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004040bc
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404330
push 0
mov eax, dword [ebp - 8]
call fcn.004044e4
mov edi, eax
push edi
mov eax, dword [0x44a11c]
mov eax, dword [eax]
call fcn.004044e4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4445b8
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0043fa6c
push esi
call sub.kernel32.dll_GlobalAddAtomA
mov word [0x44bd90], ax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0040807c
mov eax, dword [ebp - 0x20]
call fcn.004044e4
push eax
mov eax, edi
xor edx, edx
pop ecx
call fcn.0043eb08
test al, al
je 0x444580
mov ebx, 1
lea edx, [ebp - 0x24]
mov eax, 0x444688
call fcn.0043e5bc
mov eax, dword [ebp - 0x24]
call fcn.0043e750
call fcn.00403e90
jmp 0x444601
lea edx, [ebp - 0x28]
mov eax, 0x4446a4
call fcn.0043e5bc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
call fcn.0043e3a8
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004042ec
mov eax, dword [ebp - 0x28]
call fcn.0043e750
mov ax, word [0x44bd90]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
jmp 0x444601
lea edx, [ebp - 0x30]
mov eax, 0x4446bc
call fcn.0043e5bc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
call fcn.0043e3a8
mov edx, dword [ebp - 0x34]
pop eax
call fcn.004042ec
mov eax, dword [ebp - 0x30]
call fcn.0043e750
mov ax, word [0x44bd90]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
jmp 0x444601
mov ax, word [0x44bd90]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
mov ebx, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444630
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00404048
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404048
ret