joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421c85
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
xor edx, edx
inc ecx
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x120], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x421c94
push 0x40
pop esi
cmp edx, esi
jae 0x421d0f
sub esi, edx
lea ecx, [ebp + edx*4 - 0x128]
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov edx, dword [ecx - 0x34]
mov edi, esi
rol edi, 0xf
mov ebx, esi
shr esi, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, esi
mov esi, edx
rol esi, 0xe
mov ebx, edx
ror ebx, 7
xor esi, ebx
shr edx, 3
xor esi, edx
add edi, esi
add edi, dword [ecx - 0x38]
add ecx, 4
add edi, dword [ecx - 0x18]
dec dword [ebp - 4]
mov dword [ecx + 4], edi
jne 0x421cd5
mov ecx, dword [eax + 0x54]
mov edi, dword [eax + 0x50]
mov ebx, dword [eax + 0x68]
mov esi, dword [eax + 0x60]
and dword [ebp - 0x14], 0
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x64]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x6c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov ecx, esi
ror ecx, 0xb
mov edx, esi
rol edx, 7
xor ecx, edx
mov edx, esi
ror edx, 6
xor ecx, edx
mov edx, esi
not edx
and edx, ebx
mov ebx, dword [ebp - 0x10]
and ebx, esi
xor edx, ebx
add ecx, edx
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x444b00]
mov ebx, edi
add ecx, dword [ebp + edx - 0x120]
mov edx, edi
add ecx, dword [ebp - 4]
ror edx, 0xd
rol ebx, 0xa
xor edx, ebx
mov ebx, edi
add dword [ebp - 0x14], 4
ror ebx, 2
xor edx, ebx
mov ebx, dword [ebp - 8]
xor ebx, edi
and ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
and edi, dword [ebp - 0x18]
xor ebx, edi
mov edi, dword [ebp - 0x20]
add edx, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], edi
add esi, ecx
cmp dword [ebp - 0x14], 0x100
lea edi, [edx + ecx]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
jb 0x421d40
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp - 8]
add ecx, edi
mov dword [eax + 0x50], ecx
mov ecx, dword [eax + 0x54]
add ecx, edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], ecx
mov ecx, dword [eax + 0x58]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x58], ecx
mov ecx, dword [eax + 0x5c]
add ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x5c], ecx
mov ecx, dword [eax + 0x60]
add ecx, esi
mov dword [eax + 0x60], ecx
mov ecx, dword [eax + 0x64]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], ecx
mov ecx, dword [eax + 0x68]
add ecx, ebx
mov dword [eax + 0x68], ecx
mov ecx, dword [eax + 0x6c]
pop edi
add ecx, edx
pop esi
mov dword [eax + 0x6c], ecx
pop ebx
leave
ret
Function at 0x421ff0
Capabilities:
Delete registry key

Disassembly:
cmp dword [0x452d20], 0
jne 0x422008
mov dword [0x452d20], 1
jmp fcn.00422d53
ret

Function at 0x422a29
Capabilities:
Delete registry value

Disassembly:
push 0x58
mov eax, 0x43e8a1
call fcn.0042619a
mov esi, ecx
lea eax, [ebp - 0x48]
push eax
mov ebx, esi
mov edi, edx
call fcn.0040b3f7
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x34], ebx
je 0x422af3
cmp edi, ebx
jne 0x422a5c
mov edi, 0x443b60
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x422a68
lea eax, [ebp - 0x44]
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push str._s__hs__p
lea ecx, [ebp - 0x2c]
call fcn.0040bc34
add esp, 0x10
mov byte [ebp - 4], 1
cmp byte [ebp + 8], bl
je 0x422acb
lea eax, [ebp - 0x64]
push eax
call fcn.0040af72
cmp dword [eax + 0x18], 8
pop ecx
jb 0x422aa0
mov eax, dword [eax + 4]
jmp 0x422aa3
add eax, 4
cmp dword [ebp - 0x14], 8
mov ebx, dword [ebp - 0x28]
jae 0x422aaf
lea ebx, [ebp - 0x28]
mov esi, eax
mov edi, 0x452d28
call fcn.0040bcec
push 0
push 1
lea esi, [ebp - 0x64]
call fcn.00402701
xor ebx, ebx
jmp 0x422ae8
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x422ad7
lea eax, [ebp - 0x28]
push eax
push 0x452d28
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00402701
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00402701
call fcn.0042621d
ret 4

Function at 0x422d53
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44e060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, str.Softwareprojonepodlpdebug_async_
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cmp eax, 0xc6
ja 0x422df3
push ebx
push edi
push esi
mov esi, 0x452d28
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004278a0
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push edi
push 0x4445ec
push esi
call ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push esi
call ebx
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop edi
pop ebx
call fcn.00422691
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042515e
leave
ret
Function at 0x423230
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x43cf25
call fcn.00426164
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.0042520e
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x42327a
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
jne 0x423266
mov dword [esi + 0x10], edi
jmp 0x42327c
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [ecx]
jne 0x423272
push esi
jmp 0x423273
push edi
call dword [eax]
mov dword [esi + 0x10], eax
jmp 0x42327c
xor esi, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push 0x42259f
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.0041eeae
mov eax, edi
jmp 0x4232b6
call fcn.00426209
ret

Function at 0x42515e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e060]
jne 0x425168
repz ret
jmp fcn.0042623b

Function at 0x42988c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004266cf
and dword [ebp - 4], 0
cmp dword [0x451700], 0
mov ebx, eax
jne 0x42993d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4299ee
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4299ee
push eax
call fcn.0042665d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x451700], eax
call esi
push eax
call fcn.0042665d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x451704], eax
call esi
push eax
call fcn.0042665d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x451708], eax
call esi
push eax
call fcn.0042665d
pop ecx
mov dword [0x451710], eax
test eax, eax
je 0x42993d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042665d
pop ecx
mov dword [0x45170c], eax
mov eax, dword [0x45170c]
cmp eax, ebx
je 0x429995
cmp dword [0x451710], ebx
je 0x429995
push eax
call fcn.004266d8
push dword [0x451710]
mov esi, eax
call fcn.004266d8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x429995
test edi, edi
je 0x429995
call esi
test eax, eax
je 0x42998c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42998c
test byte [ebp - 0xc], 1
jne 0x429995
or dword [ebp + 0x10], 0x200000
jmp 0x4299ce
mov eax, dword [0x451704]
cmp eax, ebx
je 0x4299ce
push eax
call fcn.004266d8
pop ecx
test eax, eax
je 0x4299ce
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4299ce
mov eax, dword [0x451708]
cmp eax, ebx
je 0x4299ce
push eax
call fcn.004266d8
pop ecx
test eax, eax
je 0x4299ce
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x451700]
call fcn.004266d8
pop ecx
test eax, eax
je 0x4299ee
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4299f0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4311c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x451870], eax
je 0x4311de
mov eax, 0x10dd
jmp 0x4312bf
mov eax, dword [0x451880]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43125c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x43123a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x43123a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00431330
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00425197
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x4311e6
mov dword [0x451880], 0
call fcn.004312d0
mov ecx, dword [0x45187c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x4312a9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00425197
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x431274
mov dword [0x45187c], 0
mov dword [0x451870], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x431800
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x431815
xor eax, eax
jmp 0x43188a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x431842
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x431885
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x431883
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x43187f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x431883
xor eax, eax
jmp 0x43188a
jmp 0x431839
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x431930
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x451874], 0
je 0x431949
mov eax, dword [0x451874]
jmp 0x4319e9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x43195b
xor eax, eax
jmp 0x4319e9
push 8
call fcn.0042520e
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4319b1
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x43199a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00425197
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x451874], eax
mov dword [0x451878], 0
mov eax, dword [ebp - 4]
jmp 0x4319e9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x4319cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x43197b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x45187c]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x45187c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4322e0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004324f0
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x451864], 0
jne 0x43231d
cmp dword [0x451860], 0
je 0x43231d
mov eax, dword [0x451860]
mov dword [0x451864], eax
cmp dword [0x451864], 0
je 0x43239a
mov ecx, dword [0x451864]
cmp dword [ecx + 8], 0
je 0x43239a
mov edx, dword [0x451864]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x43239a
mov ecx, dword [0x451864]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x43239a
mov eax, dword [0x451864]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x432369
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x432370
xor eax, eax
jmp 0x4324e0
mov ecx, dword [0x451864]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004278a0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x4324e0
mov edx, dword [0x451860]
mov dword [0x451864], edx
jmp 0x4323b6
mov eax, dword [0x451864]
mov ecx, dword [eax + 4]
mov dword [0x451864], ecx
cmp dword [0x451864], 0
je 0x4323f6
cmp dword [0x451864], 0
je 0x4323f4
mov edx, dword [0x451864]
cmp dword [edx + 8], 0
je 0x4323f4
mov eax, dword [0x451864]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x4323f4
mov edx, dword [0x451864]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x4323f4
jmp 0x43234e
jmp 0x4323a8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x432427
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004326d0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x432440
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004325d0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4324de
mov ecx, dword [ebp - 4]
mov dword [0x451864], ecx
mov edx, dword [0x451864]
mov dword [edx], 0x52727464
mov eax, dword [0x451864]
mov dword [eax + 8], 0
mov ecx, dword [0x451864]
mov edx, dword [0x451860]
mov dword [ecx + 4], edx
mov eax, dword [0x451864]
mov dword [0x451860], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [0x451864]
add ecx, 0x48
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x38c
jmp 0x4324a9
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x4324cd
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x40], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x4324a0
mov ecx, dword [0x451864]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 8], edx
jmp 0x43234e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4325d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.004326a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x432695
mov edx, dword [ebp - 4]
cmp edx, dword [0x44ecd0]
jb 0x432615
mov eax, dword [ebp - 4]
cmp eax, dword [0x44ecd4]
ja 0x432615
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x4325e5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004278a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x43263b
jmp 0x432695
cmp dword [ebp - 0x10], 0x10000
jne 0x43267e
cmp dword [ebp - 0x14], 0x10000
jb 0x43267e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x432671
mov eax, dword [ebp - 0x24]
jmp 0x432697
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x432690
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.004326a0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4325e5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4326d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.004327b0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x43279d
mov edx, dword [ebp - 4]
cmp edx, dword [0x44ecd0]
jb 0x43271a
mov eax, dword [ebp - 4]
cmp eax, dword [0x44ecd4]
ja 0x43271a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x4326ea
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004278a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x432740
jmp 0x43279d
cmp dword [ebp - 0x10], 0x10000
jne 0x432783
cmp dword [ebp - 0x14], 0x10000
jb 0x432783
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x432776
mov eax, dword [ebp - 0x24]
jmp 0x43279f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x432798
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.004327b0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4326ea
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4327e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4518ac], 0
je 0x4327f6
xor eax, eax
jmp 0x432a12
cmp dword [0x4518a8], 0
je 0x432809
mov eax, dword [0x4518a8]
jmp 0x432a12
push 0x24
push 0
push 0x451884
call fcn.004278a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x451884], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x451888], eax
cmp dword [0x451888], 0
jne 0x4328ae
mov dword [0x4518ac], 1
cmp dword [0x451888], 0
je 0x432861
mov eax, dword [0x451888]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x45188c], 0
mov dword [0x451890], 0
mov dword [0x451894], 0
mov dword [0x451898], 0
mov dword [0x45189c], 0
mov dword [0x4518a0], 0
mov dword [0x4518a4], 0
xor eax, eax
jmp 0x432a12
push str.ImagehlpApiVersionEx
mov ecx, dword [0x451888]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45188c], eax
push str.SymInitialize
mov edx, dword [0x451888]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x451890], eax
push str.SymSetOptions
mov eax, dword [0x451888]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x451894], eax
push str.SymGetOptions
mov ecx, dword [0x451888]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x451898], eax
push str.SymLoadModule64
mov edx, dword [0x451888]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45189c], eax
push str.SymGetModuleInfo64
mov eax, dword [0x451888]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4518a0], eax
push str.SymFromName
mov ecx, dword [0x451888]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4518a4], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.004278a0
add esp, 0xc
mov eax, 0xb
mov word [ebp - 8], ax
cmp dword [0x45188c], 0
je 0x432993
cmp dword [0x451890], 0
je 0x432993
cmp dword [0x45189c], 0
je 0x432993
cmp dword [0x4518a0], 0
je 0x432993
cmp dword [0x4518a4], 0
jne 0x432998
jmp 0x432842
lea ecx, [ebp - 8]
push ecx
call dword [0x45188c]
movzx edx, word [ebp - 8]
cmp edx, 0xb
jge 0x4329b0
jmp 0x432842
push 0
push 0
mov eax, dword [0x451884]
push eax
call dword [0x451890]
test eax, eax
jne 0x4329c9
jmp 0x432842
cmp dword [0x451898], 0
je 0x432a03
cmp dword [0x451894], 0
je 0x432a03
call dword [0x451898]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0xfffffff8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
or edx, 0x2704
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [0x451894]
mov dword [0x4518a8], 0x451884
mov eax, dword [0x4518a8]
mov esp, ebp
pop ebp
ret
Function at 0x40483f
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x44ea38], 2
push esi
push edi
mov edi, eax
mov esi, ecx
jl 0x404853
call fcn.004036cc
mov ecx, esi
call fcn.0040481c
xor eax, eax
mov edx, dword [eax + 0x42a488]
mov ecx, dword [esi + 0xf4]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x20
jl 0x40485c
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
mov ecx, dword [esp + 0xc]
xor dword [eax + 8], ecx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
ret 4